Secure Folder 1.2 stores user‑selected vault files in Android's shared‑storage directory in plaintext. Any local application or file manager with permission to read that directory can enumerate, copy, and open the files without passing the PIN gate or authenticating to Secure Folder. The weakness is a type of information exposure through improperly stored temporary files (CWE‑922).

FluteCode Secure Folder 1.2 on Android devices. The flaw applies to the 1.2 release that uses the default shared‑storage configuration for vault storage. No other versions are listed as affected.

The CVSS score of 6.8 indicates moderate severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. The attack requires local device access and the ability to read shared storage, so it is not remotely exploitable. An attacker with a file manager or other local app can enumerate and copy the protected files, compromising the confidentiality of user data. The flaw arises from storing confidential data in an insecure location.