---
id: CVE-2026-85665
title: >-
  Bruno versions through 4.1.0 fail to validate file paths in request body
  declarations, allowing attackers to read arbitrary local files by using
  parent-directory traversal segments
summary: >-
  Bruno versions through 4.1.0 fail to validate file paths in request body
  declarations, allowing attackers to read arbitrary local files by using
  parent-directory traversal segments. When a collection is executed, attackers
  can craft a re…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'
cwe:
  - CWE-22
published: '2026-09-04'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T17:17:45.843'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-85665'
references:
  - url: 'https://github.com/usebruno/bruno'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/usebruno/bruno/blob/v4.1.0/packages/bruno-cli/src/runner/prepare-request.js
    label: disclosure@vulncheck.com
  - url: 'https://github.com/usebruno/bruno/issues/8230'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/bruno-3.4.2-arbitrary-file-read-via-unconfined-body-file-path
    label: disclosure@vulncheck.com
  - url: 'https://github.com/usebruno/bruno/issues/8230'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00703
epssPercentile: 0.51892
ingestedAt: '2026-09-06T01:47:58.633Z'
---

## Overview

Bruno versions through 4.1.0 fail to validate file paths in request body declarations, allowing attackers to read arbitrary local files by using parent-directory traversal segments. When a collection is executed, attackers can craft a request with a body:file path containing ../ sequences that resolve outside the collection directory, causing the application to read and exfiltrate arbitrary files to attacker-controlled endpoints.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.