CVE-2026-85665 | BDVDB-2026-368404 Detail

Description#

Bruno versions through 4.1.0 fail to validate file paths in request body declarations, allowing attackers to read arbitrary local files by using parent-directory traversal segments. When a collection is executed, attackers can craft a request with a body:file path containing ../ sequences that resolve outside the collection directory, causing the application to read and exfiltrate arbitrary files to attacker-controlled endpoints.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-09-04Record published in the CVE List.
2. Version 22026-09-05Most recent update recorded in the CVE List.