Bruno versions through 4.1.0 fail to validate file paths in request body declarations, allowing attackers to read arbitrary local files by using parent‑directory traversal segments. When a collection is executed, attackers can craft a request with a body:file path containing ../ sequences that resolve outside the collection directory, causing the application to read and exfiltrate arbitrary files to attacker‑controlled endpoints. This flaw is a path traversal vulnerability (CWE‑22) that enables arbitrary file read, compromising data confidentiality.

All users running Bruno 4.1.0 or earlier are affected. The vulnerability is present in the main usebruno:bruno package and impacts any installation that processes collection files containing a body:file path directive.

The CVSS score of 7.1 indicates a high severity. Bruno versions through 4.1.0 are affected, and since no EPSS rating is available, no exploitation probability is reported. The vulnerability is not listed in CISA KEV, suggesting no widespread exploitation documented. Attackers must control or modify a collection script that Bruno executes; once executed, the attacker can read arbitrary local files and send their contents to a remote location. No active exploits are known, but the flaw poses a serious risk in environments where collections originate from untrusted sources.