Vulnerability · Published Sep 4, 2026 · Assigned by VulnCheck

CVE-2026-85665Bruno through 4.1.0 Arbitrary File Read via Unconfined Body File Path

Medium 6.5

In plain English

A medium-severity path traversal in bruno from usebruno. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.8%top 44.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Bruno versions through 4.1.0 fail to validate file paths in request body declarations, allowing attackers to read arbitrary local files by using parent-directory traversal segments. When a collection is executed, attackers can craft a request with a body:file path containing ../ sequences that resolve outside the collection directory, causing the application to read and exfiltrate arbitrary files to attacker-controlled endpoints.

Affected products (as reported)

Vendor	Product	Versions
usebruno	bruno	0 – through 4.1.0

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References

GitHub Issue #8230 issue-tracking
https://github.com/usebruno/bruno product
https://github.com/usebruno/bruno/blob/v4.1.0/packages/bruno-cli/src/runner/prepare-request.js technical-description
VulnCheck Advisory: Bruno 3.4.2 Arbitrary File Read via Unconfined Body File Path third-party-advisory