Hello There, We are currently running Sonatype Nexus Repository version 3.69.0 as a Docker container. During a recent security review, we observed that the robots.txt file is publicly accessible via: https:///robots.txt We are aware of the CVE-2024-4956 advisory, which was mitigated in versions …

Hi, Yes, it is expected that you’ll still be able to access “/robots.txt” in via HTTP request in newer versions of Nexus repo. The robots.txt file and other static resources are no longer served from the file system as of Nexus Repo 3.69.0, which mitigates CVE-2024-4956. Regards, Rich

Clarification on robots.txt Exposure and CVE-2024-4956 in Nexus Repository 3.69.0

Sonatype Nexus Repository

Barath_Rajaratnam (Barath Rajaratnam) February 20, 2026, 2:28pm 3

Can static files be accessed in 3.87, if so, is there documentation on how to do it.

Topic		Replies	Views
Sonatype Nexus Repository Manager Remote Code Execution Vulnerability Advisory Sonatype Nexus Repository help	3	2516	February 7, 2019
Botnet exploitation of NXRM up to 3.14.0 Sonatype Nexus Repository	0	4129	June 13, 2019
Critical security vulnerability in NXRM 3.x versions up to 3.14 Sonatype Nexus Repository	0	1772	February 28, 2019
Sonatype Nexus Repository 3.77.1 Released Sonatype Nexus Repository nexus-repository	0	185	February 7, 2025
Sonatype Nexus Repository Manager 3 Vulnerability Advisory (Severity: High) Sonatype Nexus Repository	0	658	December 17, 2020

Clarification on robots.txt Exposure and CVE-2024-4956 in Nexus Repository 3.69.0

Related topics