CVE-2026-85665 in Bruno
Summary
by MITRE • 09/04/2026
Bruno versions through 3.4.2 fail to validate file paths in request body declarations, allowing attackers to read arbitrary local files by using parent-directory traversal segments. When a collection is executed, attackers can craft a request with a body:file path containing ../ sequences that resolve outside the collection directory, causing the application to read and exfiltrate arbitrary files to attacker-controlled endpoints.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified in Bruno versions through 3.4.2 represents a critical security flaw rooted in improper input validation of file paths within request body declarations. This issue specifically affects how the application processes requests that utilize local file inclusion mechanisms, where developers often use specific syntax to load content from the filesystem into API payloads for testing or configuration purposes. The core technical failure lies in the absence of rigorous sanitization and path normalization routines when parsing these body declarations. Instead of strictly validating that the specified file resides within an expected directory structure relative to the collection being executed, the application blindly accepts parent-directory traversal sequences such as ../ embedded in the filename parameter. This lack of boundary enforcement allows the underlying operating system's path resolution logic to interpret the sequence correctly, effectively breaking out of the intended sandbox or working directory and accessing arbitrary locations on the host file system.
From an operational perspective, this vulnerability enables a remote attacker who has access to execute Bruno collections to perform unauthorized local file reads. By crafting a malicious request body that includes carefully constructed path traversal sequences, an adversary can direct the application to read sensitive files located outside the collection's directory scope. These files may include configuration settings containing database credentials, API keys, private certificates, or other proprietary data stored on the server hosting the Bruno instance. The impact is exacerbated by the fact that this exploitation typically occurs during the execution of a collection, which implies that if an attacker can influence or supply a collection to be run within the environment, they gain immediate read access to the underlying file system without needing direct shell access or elevated privileges beyond what is required to execute API requests.
This vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-22: Improper Limitation of a Pathname to a Restricted Directory, also known as path traversal. The attack vector leverages the application's trust in user-supplied input for file system operations without verifying that the resolved absolute path remains within an allowed boundary. In terms of cybersecurity frameworks such as MITRE ATT&CK, this behavior is consistent with techniques used in Data from Local System Retrieval (T1083) and potentially File Discovery (T1083.001), where adversaries probe for sensitive information to aid in further exploitation or exfiltration. The severity of the issue is heightened by its potential integration into automated workflows, as API testing tools are often used in continuous integration pipelines where collections might be executed automatically based on external triggers or shared repositories that could be compromised.
Mitigation strategies must focus on implementing strict input validation and secure path handling mechanisms within the application code responsible for processing body file declarations. Developers should enforce allowlisting of permitted directories rather than relying solely on blacklist approaches, which are prone to bypass via encoding variations or traversal sequences. It is essential to resolve all symbolic links and normalize paths before checking them against a whitelist of allowed base directories. Additionally, applying the principle of least privilege ensures that even if an attacker succeeds in reading files, they cannot access sensitive system-level configurations by restricting the Bruno process's file system permissions. Upgrading to patched versions where this validation logic has been corrected is the primary remediation step for existing deployments, while future development cycles should incorporate static analysis tools and security testing focused on path traversal vulnerabilities to prevent similar issues from arising in other parts of the application.