CVE-2026-77884: Gallery - Private Photo Vault 1.0.41 - Unauthenticated local-network HTTP file exposure
Published Sep 14, 2026
·Updated
Gallery - Private Photo Vault 1.0.41 starts an unauthenticated HTTP server that is reachable from the local network. The server listens on TCP port 8080 and serves files and directory listings from Android external storage.
Affected Software
1 affected component
Gallery - Private Photo Vault=1.0.41
Event History
Sep 14, 2026
CVE Published
via MITRE·06:02 PM
Data Sourced
via MITRE·06:02 PM
DescriptionWeakness
Frequently Asked Questions
1
Who can access the exposed files?
Any device that can reach the affected Android device over its local network can access the unauthenticated HTTP service on TCP port 8080.
2
What data may be exposed through the service?
The server serves files and directory listings from Android external storage, so content stored there may be accessible to local-network clients.
3
What does an attacker need to exploit this issue?
An attacker needs local-network reachability to the Android device and the ability to connect to TCP port 8080; no authentication is required.