EUVD-2026-77755
GHSA-2qp8-r85p-fw36
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent-only network vector; zero authentication; high confidentiality loss; no integrity or availability impact described.
Primary rating from Vendor (Fluid Attacks).
CVSS VectorVendor: Fluid Attacks
Lifecycle Timeline
3DescriptionCVE.org
Gallery - Private Photo Vault 1.0.41 starts an unauthenticated HTTP server that is reachable from the local network. The server listens on TCP port 8080 and serves files and directory listings from Android external storage.
AnalysisAI
Gallery - Private Photo Vault 1.0.41 (Android, by Brain Trust) exposes an unauthenticated HTTP server on TCP port 8080 that is reachable by any device on the same local network, serving full directory listings and file contents from Android external storage - the very media the app is marketed to protect. Any network-adjacent attacker can trivially enumerate and exfiltrate photos, videos, and other files without credentials or user interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to be on the same local network (Wi-Fi subnet or broadcast domain) as the Android device running Gallery - Private Photo Vault 1.0.41 - this is the AV:A constraint and the primary limiting factor. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.1 (AV:A/AC:L/AT:N/PR:N/UI:N/VC:H) accurately reflects the real-world risk profile: high confidentiality impact, zero authentication barrier, and low complexity once adjacency is satisfied, but constrained to the local network. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, determine if Gallery - Private Photo Vault v1.0.41 is installed on organizational devices or connected to corporate networks; notify affected users and security team immediately if found. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today