CVE-2026-78255

The HTTP media server running on DJI drones serves stored photos and videos through the `/v2` endpoint without authenticating the requesting client. Filenames follow a predictable pattern, allowing an attacker who joins the drone's internal network to enumerate valid filenames and exfiltrate stored photos and videos. The exposed media may reveal sensitive information, including private locations, property, travel history, identifiable individuals, and the operator's routines. Affected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.

• CWE-306

• https://support.dji.com/help/content?customId=en-us03400011149&spaceId=34&re=US&lang=en

Published

Aug 24, 2026

Last Modified

Aug 24, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-78244A vulnerability was detected in itsourcecode Real Estate Man…7.3
• CVE-2026-78245A flaw has been found in itsourcecode Online Pharmacy System…7.3
• CVE-2026-78246A vulnerability has been found in itsourcecode Online Clinic…7.3
• CVE-2026-78247A vulnerability was found in SourceCodester Simple Online Fo…7.3
• CVE-2026-78248A vulnerability was determined in SourceCodester Simple Onli…7.3
• CVE-2026-78250A vulnerability was identified in bytebot-ai bytebot 0.0.1. …4.3
• CVE-2026-78258Unauthenticated Broken Access Control in Booking and Rental …5.3
• CVE-2026-78269Contributor Server Side Request Forgery (SSRF) in Shared Fil…6.4
• CVE-2026-78270Author SQL Injection in FluentCRM Pro <= 3.1.12 versions.7.6
• CVE-2026-78272Subscriber Broken Access Control in Fluent Support Pro <= 2.…5.4
• CVE-2026-78277Subscriber Server Side Request Forgery (SSRF) in FluentCRM P…4.9
• CVE-2026-78278Subscriber Insecure Direct Object References (IDOR) in Fluen…5.3