CVE-2026-85665
Bruno through 4.1.0 Arbitrary File Read via Unconfined Body File Path
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
Bruno versions through 4.1.0 fail to validate file paths in request body declarations, allowing attackers to read arbitrary local files by using parent-directory traversal segments. When a collection is executed, attackers can craft a request with a body:file path containing ../ sequences that resolve outside the collection directory, causing the application to read and exfiltrate arbitrary files to attacker-controlled endpoints.
| CWE | CWE-22 |
| Vendor | usebruno |
| Product | bruno |
| Published | Sep 4, 2026 |
| Last Updated | Sep 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for usebruno bruno
Be the first to know when new medium vulnerabilities affecting usebruno bruno are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
usebruno / bruno
0 ≤ 4.1.0
References
github.com: https://github.com/usebruno/bruno/issues/8230 github.com: https://github.com/usebruno/bruno github.com: https://github.com/usebruno/bruno/blob/v4.1.0/packages/bruno-cli/src/runner/prepare-request.js vulncheck.com: https://www.vulncheck.com/advisories/bruno-3.4.2-arbitrary-file-read-via-unconfined-body-file-path
Credits
George Chen