CVE-2026-85665

Bruno through version 4.1.0 fails to validate file paths in request body declarations (body:file), allowing parent-directory '../' traversal sequences to resolve outside the collection directory (CWE-22). An attacker triggers the flaw by getting a user to execute a crafted collection whose body file path points outside the collection folder, for example a collection shared via file transfer, a repository, or downloaded from the internet. On execution, Bruno reads the referenced file and transmits its contents to attacker-controlled endpoints, enabling arbitrary local file disclosure and exfiltration with high confidentiality impact but no integrity or availability impact. Anyone running an affected version of the Bruno API client and executing collections authored or modified by others is affected. No exploitation has been reported: there is no public proof-of-concept, the CVE is not in CISA KEV, and EPSS assigns only a 0.7% probability of exploitation within 30 days.

What to do: Upgrade Bruno to the first release after 4.1.0 as soon as a patched version is published, since the available data does not identify a fixed version number. Until then, avoid running collections from untrusted sources and inspect any collection's body:file paths for '../' traversal segments before executing. On machines that hold sensitive credentials or files, consider restricting Bruno's file system access to intended project directories.