High 8.7Published Aug 24, 2026

CVE-2026-78255DJI Drone HTTP Media Server Allows Unauthenticated Access to Stored Media

Updated under an hour ago (Oct 26, 2026, 2:50 PM ET)

Does this affect you?

It affects DJI Neo and 15 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for DJI Neo

Exploited in the last 30 days

The HTTP media server running on DJI drones serves stored photos and videos through the `/v2` endpoint without authenticating the requesting client. Filenames follow a predictable pattern, allowing an attacker who joins the drone's internal network to enumerate valid filenames and exfiltrate stored photos and videos. The exposed media may reveal sensitive information, including private locations, property, travel history, identifiable individuals, and the operator's routines. Affected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600.

CVSS: 8.7 HIGH (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N
Weakness (CWE): CWE-306
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: CIRCL
NVD analysis: Deferred
Record last updated: Aug 24, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

DJI Neo dji:neo (from the name)	through 01.00.0400	CNA record
DJI Neo 2 dji:neo_2 (from the name)	through 01.00.0500	CNA record
DJI Flip dji:flip (from the name)	through 01.00.1200	CNA record
DJI Air 3 dji:air_3 (from the name)	through 01.00.1600,	CNA record
DJI Air 3S dji:air_3s (from the name)	through 01.00.1400	CNA record
DJI Avata 2 dji:avata_2 (from the name)	through 01.00.0400	CNA record
DJI Avata 360 dji:avata_360 (from the name)	through 01.00.0300	CNA record
DJI Mavic 3 dji:mavic_3 (from the name)	through 01.00.1400	CNA record
DJI Mavic 3 Classic dji:mavic_3_classic (from the name)	through 01.00.0800	CNA record
DJI Mavic 3 Pro dji:mavic_3_pro (from the name)	through 01.01.0700	CNA record
1–10 of 16

References

References

https://support.dji.com/help/content?customId=en-us03400011149&spaceId=34&re=US&lang=en	product

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.