The vulnerability is a missing authentication flaw in the SignalR Hub UploadFile endpoint of GiantappMan LiveWallpaper 2.6.8.0. By manipulating requests, an attacker can upload files without authentication, potentially inserting malicious artifacts that, if processed by the application, could lead to remote code execution or other destructive actions. The flaw is classified as CWE‑287 and CWE‑306.

The affected system is GiantappMan LiveWallpaper version 2.6.8.0 running on Windows. No other versions or platforms are indicated, so the issue is confined to this particular release.

The CVSS base score is 6.9, indicating moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. However, the official advisory notes that the exploit is publicly available and can be performed remotely. Because the flaw removes a critical authentication step, an off‑site attacker can upload arbitrary files, which may subsequently be executed if the application accepts or processes them, thereby increasing the risk of unauthorized access to protected resources.