CVE-2026-85665 Details
Description
Bruno versions through 4.1.0 fail to validate file paths in request body declarations, allowing attackers to read arbitrary local files by using parent-directory traversal segments. When a collection is executed, attackers can craft a request with a body:file path containing ../ sequences that resolve outside the collection directory, causing the application to read and exfiltrate arbitrary files to attacker-controlled endpoints.
A path traversal vulnerability has been identified in Bruno versions through 4.1.0. The issue arises because the application fails to properly validate file paths in request body declarations. This flaw allows attackers to read arbitrary local files by exploiting parent-directory traversal segments. When a collection is executed, a crafted request can be sent with a body:file path that includes ../ sequences, which resolve outside the collection directory. As a result, the application reads and exfiltrates these files to attacker-controlled endpoints.
Users are advised to update to Bruno version 4.2.0 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 4, 2026CISA-ADP
Assessed Sep 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/usebruno/bruno/issues/8230 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/usebruno/bruno | [email protected] | Vendor |
| https://github.com/usebruno/bruno/blob/v4.1.0/packages/bruno-cli/src/runner/prepare-request.js | [email protected] | Source CodeVendor |
| https://github.com/usebruno/bruno/issues/8230 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/bruno-3.4.2-arbitrary-file-read-via-unconfined-body-file-path | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Bruno | <= 4.1.0 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 5, 2026 | CVE Modified | [email protected] |
| Sep 4, 2026 | CVE Modified | CISA-ADP |
| Sep 4, 2026 | New CVE Received | [email protected] |