CVE-2026-85665: Bruno 3.4.2 Arbitrary File Read via Unconfined Body File Path
Bruno versions through 3.4.2 fail to validate file paths in request body declarations, allowing attackers to read arbitrary local files by using parent-directory traversal segments. When a collection is executed, attackers can craft a request with a body:file path containing ../ sequences that resolve outside the collection directory, causing the application to read and exfiltrate arbitrary files to attacker-controlled endpoints.
Affected Software
Event History
Frequently Asked Questions
What must an attacker be able to do to exploit this issue?
They must be able to craft or modify a Bruno collection request containing a body:file path with ../ traversal segments, and induce execution of that collection. The request must send data to an attacker-controlled endpoint for the file contents to be exfiltrated.
Who is most exposed?
Users or automation that execute untrusted Bruno collections are most exposed. The issue can cause the system running Bruno to read files outside the collection directory without requiring attacker privileges.
How can I determine whether a collection is affected?
Inspect request body:file declarations for paths containing ../ segments or other paths that resolve outside the intended collection directory. Collections that send such file-backed request bodies to untrusted endpoints should be treated as potentially malicious.
What can be done if an update is not immediately possible?
Do not execute untrusted collections, and review collection request body:file paths before execution. Run Bruno only in an environment that cannot access sensitive local files, and prevent outbound requests to untrusted endpoints where feasible.