{"id":"CVE-2026-85665","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-85665","summary":"Bruno versions through 3.4.2 fail to validate file paths in request body declarations, allowing attackers to read arbitrary local files by using parent-directory traversal segments.…","details":"Bruno versions through 3.4.2 fail to validate file paths in request body declarations, allowing attackers to read arbitrary local files by using parent-directory traversal segments. When a collection is executed, attackers can craft a request with a body:file path containing ../ sequences that resolve outside the collection directory, causing the application to read and exfiltrate arbitrary files to attacker-controlled endpoints.","published":"2026-09-04T15:17:44.247","modified":"2026-09-04T15:17:44.247","cvss":{"score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":null,"references":[{"type":"WEB","url":"https://github.com/usebruno/bruno"},{"type":"WEB","url":"https://github.com/usebruno/bruno/blob/v4.1.0/packages/bruno-cli/src/runner/prepare-request.js"},{"type":"WEB","url":"https://github.com/usebruno/bruno/issues/8230"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/bruno-3.4.2-arbitrary-file-read-via-unconfined-body-file-path"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-09-04T15:17:44.247"}}