Description

Bruno versions through 3.4.2 fail to validate file paths in request body declarations, allowing attackers to read arbitrary local files by using parent-directory traversal segments. When a collection is executed, attackers can craft a request with a body:file path containing ../ sequences that resolve outside the collection directory, causing the application to read and exfiltrate arbitrary files to attacker-controlled endpoints.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-04T15:17:44.247Z",
  "pubdate": "2026-09-04T15:17:44.247Z",
  "executiveSummary": "Bruno versions through 3.4.2 are susceptible to an arbitrary file read vulnerability resulting from improper validation of file path declarations within request body definitions. This vulnerability allows an attacker to bypass directory constraints by leveraging path traversal sequences, facilitating unauthorized access to sensitive local files.\nThe flaw exists within the application's request body processing logic. When a user-defined collection is executed, the application fails to adequately sanitize file paths, permitting the use of parent-directory traversal segments (e.g., ../).\nAn attacker can exploit this by crafting a malicious collection request that points to unauthorized locations on the host filesystem. Upon execution, the application reads the contents of the targeted file, potentially exfiltrating sensitive data to an external, attacker-controlled endpoint.\nThis vulnerability poses a significant risk to confidentiality, as it grants attackers the capability to read arbitrary files reachable by the user running the Bruno application. No specific authentication beyond the ability to define or execute a collection is required, making it a critical concern for users handling sensitive collections.",
  "technicalDetails": "The vulnerability stems from insufficient input validation and path canonicalization within the Bruno request body processing module. Specifically, the application logic fails to implement effective sandboxing or path prefix checking when processing file-based request bodies defined in collection configurations.\nThe root cause is a Path Traversal vulnerability (CWE-22) where user-supplied path strings are concatenated or utilized directly by file system APIs without verifying that the resulting path resides within the intended collection directory structure. By injecting sequences such as '../', an attacker can escape the designated directory context and traverse to arbitrary locations on the host operating system.\nThe attack flow proceeds as follows: First, an attacker modifies a request body definition within a Bruno collection to include a path pointing to a sensitive local file, such as '/etc/passwd' or user configuration files, using traversal notation. Second, the attacker executes the collection. Third, the Bruno engine, while processing the request body, interprets the path traversal sequences and attempts to resolve the absolute path on the host system. Finally, because the application does not validate the integrity of the resolved path against the collection root, it proceeds to read the file contents.\nThe behavior of the payload is to force the application to treat the contents of the targeted arbitrary file as the request body payload. During the request execution process, this payload is subsequently transmitted to the target URL defined in the collection request. If the attacker controls the target endpoint, the sensitive content of the accessed file is exfiltrated to the attacker's server.\nThe affected component is the request body handling routine responsible for loading file contents into memory or transmission buffers during collection execution. All versions of Bruno through 3.4.2 are confirmed to be vulnerable. Exploitation does not require elevated privileges beyond the ability to run the application, and the impact is limited by the filesystem permissions of the user account currently executing the Bruno instance. Post-exploitation impact includes the potential compromise of secrets, configuration tokens, or system-level data accessible to the user, significantly expanding an attacker's reach within the host environment."
}