CVE-2026-84283 PUBLISHED

FluteCode Secure Folder 1.2 -Plaintext vault files in shared storage bypass the PIN gate

Assigner: Fluid Attacks
Reserved: 01.09.2026 Published: 24.09.2026 Updated: 24.09.2026

Secure Folder 1.2 stores files selected for its password-protected vault as unencrypted files in the Android shared-storage tree. A local application or file manager that has access to the relevant shared-storage path can enumerate, copy, and open those files without authenticating to Secure Folder.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS Score: 6.8

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Local	Confidentiality	High	Confidentiality	None
Attack Complexity	Low	Integrity	None	Integrity	None
Attack Requirements	None	Availability	None	Availability	None
Privileges Required	Low
User Interaction	None

CVSS 4.0

Product Status

Vendor	FluteCode
Product	Secure Folder
Versions	Default: unaffected Version 1.2 is affected

Credits

Andrés Ramos finder

References

Problem Types

CWE-922 Insecure Storage of Sensitive Information CWE

Impacts

CAPEC-639 Probe System Files