CVE-2026-116110

GiantappMan LiveWallPaper SignalR Hub UploadFile missing authentication

View on CVE.org
Published Oct 26, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was found in GiantappMan LiveWallPaper 2.6.8.0 on Windows. This issue affects some unknown processing of the file /LiveWallpaper/UploadFile of the component SignalR Hub. Performing a manipulation results in missing authentication. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The patch is named b62f878899adbfc2968e3345442f3a3df91b774d. It is suggested to install a patch to address this issue. The vendor was contacted early about this disclosure.

Analysis

AI-generated

Technical impact

The vulnerability is a missing authentication flaw in the SignalR Hub UploadFile endpoint of GiantappMan LiveWallpaper 2.6.8.0. By manipulating requests, an attacker can upload files without authentication, potentially inserting malicious artifacts that, if processed by the application, could lead to remote code execution or other destructive actions. The flaw is classified as CWE‑287 and CWE‑306.

Affected Systems

The affected system is GiantappMan LiveWallpaper version 2.6.8.0 running on Windows. No other versions or platforms are indicated, so the issue is confined to this particular release.

Risk and Exploitability

The CVSS base score is 6.9, indicating moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. However, the official advisory notes that the exploit is publicly available and can be performed remotely. Because the flaw removes a critical authentication step, an off‑site attacker can upload arbitrary files, which may subsequently be executed if the application accepts or processes them, thereby increasing the risk of unauthorized access to protected resources.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the patch referenced by commit b62f878899adbfc2968e3345442f3a3df91b774d to update GiantappMan LiveWallpaper to a fixed version.
  • Restrict access to the /LiveWallpaper/UploadFile endpoint so that only authorized users or the local machine can reach it, e.g., via firewall rules or application‑level authentication.
  • Implement file‑type validation and antivirus scanning on all uploads, and configure the application to reject files that are not explicitly allowed.

Generated by OpenCVE AI on October 26, 2026 at 03:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was found in GiantappMan LiveWallPaper 2.6.8.0 on Windows. This issue affects some unknown processing of the file /LiveWallpaper/UploadFile of the component SignalR Hub. Performing a manipulation results in missing authentication. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The patch is named b62f878899adbfc2968e3345442f3a3df91b774d. It is suggested to install a patch to address this issue. The vendor was contacted early about this disclosure.
Title GiantappMan LiveWallPaper SignalR Hub UploadFile missing authentication
First Time appeared Giantappman
Giantappman livewallpaper
Weaknesses CWE-287
CWE-306
CPEs cpe:2.3:a:giantappman:livewallpaper:*:*:*:*:*:*:*:*
Vendors & Products Giantappman
Giantappman livewallpaper
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-287

    Improper Authentication

  • CWE-306

    Missing Authentication for Critical Function

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Nov 2, 2026, 4:48 PM
Reserved
Oct 25, 2026, 8:22 AM

View source JSON

Updated
Nov 2, 2026, 4:48 PM

JSON

Status
Deferred
Published
Oct 26, 2026, 3:17 AM
Modified
Nov 2, 2026, 5:17 PM

View source JSON

No data.

Updated
Oct 26, 2026, 6:52 PM

JSON