{"id":"CVE-2026-85665","title":"Bruno versions through 4.1.0 fail to validate file paths in request body declarations, allowing attackers to read arbitrary local files by using parent-directory traversal segments","summary":"Bruno versions through 4.1.0 fail to validate file paths in request body declarations, allowing attackers to read arbitrary local files by using parent-directory traversal segments. When a collection is executed, attackers can craft a re…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","cwe":["CWE-22"],"published":"2026-09-04","updated":"2026-09-05","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85665","references":[{"url":"https://github.com/usebruno/bruno","label":"disclosure@vulncheck.com"},{"url":"https://github.com/usebruno/bruno/blob/v4.1.0/packages/bruno-cli/src/runner/prepare-request.js","label":"disclosure@vulncheck.com"},{"url":"https://github.com/usebruno/bruno/issues/8230","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/bruno-3.4.2-arbitrary-file-read-via-unconfined-body-file-path","label":"disclosure@vulncheck.com"},{"url":"https://github.com/usebruno/bruno/issues/8230","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd"],"epss":0.00703,"epssPercentile":0.51464,"ingestedAt":"2026-09-06T01:47:58.633Z","slug":"CVE-2026-85665","body":"## Overview\n\nBruno versions through 4.1.0 fail to validate file paths in request body declarations, allowing attackers to read arbitrary local files by using parent-directory traversal segments. When a collection is executed, attackers can craft a request with a body:file path containing ../ sequences that resolve outside the collection directory, causing the application to read and exfiltrate arbitrary files to attacker-controlled endpoints.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}