What’s Vulnerable › Vulnerabilities

CVE-2026-85665: Bruno through 4.1.0 Arbitrary File Read via Unconfined Body File Path

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-04 · updated 2026-09-23
• Weakness: CWE-22

Description

Bruno versions through 4.1.0 fail to validate file paths in request body declarations, allowing attackers to read arbitrary local files by using parent-directory traversal segments. When a collection is executed, attackers can craft a request with a body:file path containing ../ sequences that resolve outside the collection directory, causing the application to read and exfiltrate arbitrary files to attacker-controlled endpoints.

Affected products

• usebruno bruno: through 4.1.0

References

• https://github.com/usebruno/bruno
• https://github.com/usebruno/bruno/blob/v4.1.0/packages/bruno-cli/src/runner/prepare-request.js
• https://github.com/usebruno/bruno/issues/8230
• https://www.vulncheck.com/advisories/bruno-3.4.2-arbitrary-file-read-via-unconfined-body-file-path
• https://github.com/usebruno/bruno/issues/8230

Get alerted when CVE-2026-85665 or the next vulnerability affects your stack