CVE-2026-85665

Name of the Vulnerable Software and Affected Versions Bruno versions prior to 4.1.1

Description Insufficient validation of file paths in request body declarations allows for parent-directory traversal. This occurs when a collection is executed and a request contains a body:file path with ../ sequences that resolve outside the collection directory, enabling the reading and exfiltration of arbitrary local files to external endpoints.

Recommendations Update Bruno to version 4.1.1 or later.