EUVD-2026-71121
GHSA-c887-2p5m-25wx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-distributed collection, no attacker privileges needed, but victim must actively run it (UI:R); only confidentiality impact from arbitrary file read.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Bruno versions through 3.4.2 fail to validate file paths in request body declarations, allowing attackers to read arbitrary local files by using parent-directory traversal segments. When a collection is executed, attackers can craft a request with a body:file path containing ../ sequences that resolve outside the collection directory, causing the application to read and exfiltrate arbitrary files to attacker-controlled endpoints.
AnalysisAI
Path traversal in Bruno API client through version 3.4.2 allows an attacker who can deliver a crafted collection to a victim to exfiltrate arbitrary local files from the victim's filesystem. When a user executes a Bruno collection containing a body:file request with ../ traversal sequences in the file path, the application resolves the path outside the collection directory and transmits the resulting file contents to an attacker-controlled HTTP endpoint. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the victim user (1) imports a collection authored or modified by the attacker, and (2) actively executes that collection using the Bruno CLI or desktop application. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N) scores 7.1 and accurately captures the core risk: network-distributable, low-complexity attack requiring only passive user interaction (running the collection) to achieve full confidentiality compromise of local files. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Bruno to version 4.1.0 or later, which contains the corrected path validation in `prepare-request.js` as confirmed by the GitHub commit reference. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Bruno installations in your organization and audit which teams are using version 3.4.2 or earlier. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Bruno is an open source IDE for exploring and testing APIs. Rated high severity (CVSS 8.7), this vulnerability is no aut
Bruno is an open source IDE for exploring and testing APIs. Rated high severity (CVSS 8.7), this vulnerability is no aut
Bruno before 1.29.1 uses Electron shell.openExternal without validation (of http or https) for opening windows within th
An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to imperson
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today