CVE-2023-50263

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. In Nautobot 1.x and 2.0.x prior to 1.6.7 and 2.0.6, the URLs `/files/get/?name=...` and `/files/download/?name=...` are used to provide admin access to files that have been uploaded as part of a run request for a Job that has FileVar inputs. Under normal operation these files are ephemeral and are deleted once the Job in question runs. In the default implementation used in Nautobot, as provided by `django-db-file-storage`, these URLs do not by default require any user authentication to access; they should instead be restricted to only users who have permissions to view Nautobot's `FileProxy` model instances. Note that no URL mechanism is provided for listing or traversal of the available file `name` values, so in practice an unauthenticated user would have to guess names to discover arbitrary files for download, but if a user knows the file name/path value, they can access it without authenticating, so we are considering this a vulnerability. Fixes are included in Nautobot 1.6.7 and Nautobot 2.0.6. No known workarounds are available other than applying the patches included in those versions.

• CWE-200
• CWE-306

• https://github.com/nautobot/nautobot/commit/458280c359a4833a20da294eaf4b8d55edc91ceePatch
• https://github.com/nautobot/nautobot/commit/7c4cf3137f45f1541f09f2f6a7f8850cd3a2eaeePatch
• https://github.com/nautobot/nautobot/pull/4959Patch
• https://github.com/nautobot/nautobot/pull/4964Patch
• https://github.com/nautobot/nautobot/security/advisories/GHSA-75mc-3pjc-727qPatch, Vendor Advisory
• https://github.com/victor-o-silva/db_file_storage/blob/master/db_file_storage/views.pyProduct
• https://github.com/nautobot/nautobot/commit/458280c359a4833a20da294eaf4b8d55edc91ceePatch
• https://github.com/nautobot/nautobot/commit/7c4cf3137f45f1541f09f2f6a7f8850cd3a2eaeePatch
• https://github.com/nautobot/nautobot/pull/4959Patch
• https://github.com/nautobot/nautobot/pull/4964Patch
• https://github.com/nautobot/nautobot/security/advisories/GHSA-75mc-3pjc-727qPatch, Vendor Advisory
• https://github.com/victor-o-silva/db_file_storage/blob/master/db_file_storage/views.pyProduct

Published

Dec 12, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-50257eProsima Fast DDS (formerly Fast RTPS) is a C++ implementati…8.1
• CVE-2023-50258Medusa is an automatic video library manager for TV shows. V…5.3
• CVE-2023-50259Medusa is an automatic video library manager for TV shows. V…5.3
• CVE-2023-5026A vulnerability classified as problematic has been found in …6.1
• CVE-2023-50260Wazuh is a free and open source platform used for threat pre…8.8
• CVE-2023-50262Dompdf is an HTML to PDF converter for PHP. When parsing SVG…7.5
• CVE-2023-50264Bazarr manages and downloads subtitles. Prior to 1.3.1, Baza…7.5
• CVE-2023-50265Bazarr manages and downloads subtitles. Prior to 1.3.1, the …7.5
• CVE-2023-50266Bazarr manages and downloads subtitles. In version 1.2.4, th…5.3
• CVE-2023-50267MeterSphere is a one-stop open source continuous testing pla…4.3
• CVE-2023-50268jq is a command-line JSON processor. Version 1.7 is vulnerab…5.5
• CVE-2023-50269Squid is a caching proxy for the Web. Due to an Uncontrolled…7.5