CVE-2026-85665
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Sep 04, 2026
Vendor
unknown
Description
Bruno versions through 3.4.2 fail to validate file paths in request body declarations, allowing attackers to read arbitrary local files by using parent-directory traversal segments. When a collection is executed, attackers can craft a request with a body:file path containing ../ sequences that resolve outside the collection directory, causing the application to read and exfiltrate arbitrary files to attacker-controlled endpoints.