CVE-2026-85665: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in usebruno bruno

CVE-2026-85665 is a path traversal vulnerability in usebruno's Bruno product affecting versions up to 4.1.0. The flaw arises from insufficient validation of file paths in request body declarations, allowing attackers to craft requests with '../' sequences that cause the application to access and exfiltrate arbitrary local files outside the collection directory. This vulnerability has a CVSS 4.0 base score of 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, and high impact on confidentiality.

Successful exploitation allows an unauthenticated attacker to read arbitrary files on the local filesystem, potentially exposing sensitive information. The vulnerability impacts confidentiality but does not affect integrity or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should restrict access to the application and monitor for suspicious requests containing path traversal sequences. Avoid exposing the vulnerable versions to untrusted networks.