CVE-2026-77884

Gallery – Private Photo Vault 1.0.41 for Android starts an unauthenticated HTTP server that listens on TCP port 8080 and is reachable from the local network, classified as CWE-552 (files or directories accessible to external parties). Any attacker on the same Wi-Fi or LAN segment can connect with no credentials and browse directory listings and download files from Android external storage. This defeats the app's core purpose of protecting private media, exposing stored photos and any other files in those directories to read access; the flaw is rated CVSS:4.0 7.1 (high) with an adjacent-network attack vector and high confidentiality impact. Users running version 1.0.41 are affected whenever the app's server is active and the device is on a shared network such as public or home Wi-Fi. No public proof of concept is known, there is no evidence of in-the-wild exploitation, and the CVE is not in CISA's KEV catalog.

What to do: Upgrade Gallery – Private Photo Vault past version 1.0.41 as soon as the vendor releases a fixed build, since 1.0.41 is the confirmed affected version. In the interim, avoid running the app on shared or untrusted Wi-Fi, enable AP/client isolation on routers you control, or uninstall the app and revoke its storage permissions. From another device on the same network, check whether the phone responds on TCP port 8080 to confirm whether the vulnerable server is exposed.