Executive brief
Gallery - Private Photo Vault is an Android app designed to securely store private photos. Version 1.0.41 inadvertently exposes all files stored on the device's external storage by starting an unauthenticated HTTP server accessible to other devices on the local network, allowing anyone connected to the same Wi-Fi to browse and download sensitive photos and files.
Technical details
The vulnerability is a lack of authentication and network segmentation in a bundled HTTP server. The application starts an HTTP server listening on TCP port 8080 that serves directory listings and file downloads from the Android external storage directory without requiring any credentials or token validation. The attack vector is network-adjacent (local network reachable), requiring no user interaction beyond the app being installed and running. An attacker on the same Wi-Fi network can enumerate and retrieve all exposed files. No patch information is currently available for this version.
Affected products
- <UNKNOWN> Gallery - Private Photo Vault 1.0.41
Timeline
- 2026-09-14: disclosed