Vulnerability Description
Bruno versions through 4.1.0 fail to validate file paths in request body declarations, allowing attackers to read arbitrary local files by using parent-directory traversal segments. When a collection is executed, attackers can craft a request with a body:file path containing ../ sequences that resolve outside the collection directory, causing the application to read and exfiltrate arbitrary files to attacker-controlled endpoints.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/usebruno/bruno
- https://github.com/usebruno/bruno/blob/v4.1.0/packages/bruno-cli/src/runner/prep
- https://github.com/usebruno/bruno/issues/8230
- https://www.vulncheck.com/advisories/bruno-3.4.2-arbitrary-file-read-via-unconfi
- https://github.com/usebruno/bruno/issues/8230
FAQ
What is CVE-2026-85665?
CVE-2026-85665 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Bruno versions through 4.1.0 fail to validate file paths in request body declarations, allowing attackers to read arbitrary local files by using parent-directory traversal segments. When a collection ...
How severe is CVE-2026-85665?
CVE-2026-85665 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-85665?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.