medium6.5
CVE-2026-85665
Bruno versions through 4.1.0 fail to validate file paths in request body declarations, allowing attackers to read arbitrary local files by using parent-directo…
Impact
Bruno versions through 4.1.0 fail to validate file paths in request body declarations, allowing attackers to read arbitrary local files by using parent-directory traversal segments. When a collection is executed, attackers can craft a request with a body:file path containing ../ sequences that resolve outside the collection directory, causing the application to read and exfiltrate arbitrary files to attacker-controlled endpoints.
Affected products
| Product | Affected versions |
|---|---|
| Bruno | through 4.1.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/usebruno/bruno
- https://github.com/usebruno/bruno/blob/v4.1.0/packages/bruno-cli/src/runner/prepare-request.js
- https://github.com/usebruno/bruno/issues/8230
- https://www.vulncheck.com/advisories/bruno-3.4.2-arbitrary-file-read-via-unconfined-body-file-path
- https://github.com/usebruno/bruno/issues/8230