{"id":"CVE-2026-116110","kind":"vulnerability","aliases":["CVE-2026-116110"],"related":[],"title":"LiveWallPaper for Windows: SignalR upload endpoint lacks authentication, enabling remote access","description":"A vulnerability was found in GiantappMan LiveWallPaper 2.6.8.0 on Windows. This issue affects some unknown processing of the file /LiveWallpaper/UploadFile of the component SignalR Hub. Performing a manipulation results in missing authentication. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The patch is named b62f878899adbfc2968e3345442f3a3df91b774d. It is suggested to install a patch to address this issue. The vendor was contacted early about this disclosure.","summary":"GiantappMan LiveWallPaper 2.6.8.0 on Windows exposes a SignalR Hub file-upload path (/LiveWallpaper/UploadFile) that performs no authentication check. A remote attacker can reach it over the network without credentials, and a public exploit has been released.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop-apps","livewallpaper","package","windows"],"not_affected_if":["local-only-binding"],"how_to_check":"- Check the installed LiveWallPaper version on Windows; affected version is `2.6.8.0`\n- Confirm whether the app's SignalR hub is reachable on the network (`unknown` port from sources)\n- Look for requests to `/LiveWallpaper/UploadFile` in web or app logs","fix":"- Install the patch referenced by the vendor, commit `b62f878899adbfc2968e3345442f3a3df91b774d`, or move to a release that includes it (version unknown from sources)\n- Until patched, block network access to the LiveWallPaper port from untrusted networks","status":"open","published_at":"2026-10-26T03:17:11+00:00","first_seen_at":"2026-10-26T03:39:26+00:00","triaged_at":"2026-10-26T03:40:01+00:00","updated_at":"2026-10-26T03:40:01+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T03:40:01Z","model":"claude-haiku-5-5","output":{"fix":"- Install the patch referenced by the vendor, commit `b62f878899adbfc2968e3345442f3a3df91b774d`, or move to a release that includes it (version unknown from sources)\n- Until patched, block network access to the LiveWallPaper port from untrusted networks","reach":"internet","title":"LiveWallPaper for Windows: SignalR upload endpoint lacks authentication, enabling remote access","impact":"high","summary":"GiantappMan LiveWallPaper 2.6.8.0 on Windows exposes a SignalR Hub file-upload path (/LiveWallpaper/UploadFile) that performs no authentication check. A remote attacker can reach it over the network without credentials, and a public exploit has been released.","category":"package","nicknames":[],"who_cares":["windows","desktop-apps","livewallpaper"],"confidence":0.6,"needs_auth":"no","worst_case":"Remote attacker uploads files to the Windows host without credentials","analyst_note":"Confirm the fixed release version and whether the default install binds the SignalR hub to all interfaces; the sources give only a commit hash.","how_to_check":"- Check the installed LiveWallPaper version on Windows; affected version is `2.6.8.0`\n- Confirm whether the app's SignalR hub is reachable on the network (`unknown` port from sources)\n- Look for requests to `/LiveWallpaper/UploadFile` in web or app logs","needs_analyst":true,"not_affected_if":["local-only-binding"],"who_is_affected":"Windows installations of GiantappMan LiveWallPaper version 2.6.8.0 that accept network connections to the SignalR hub. Machines where the app runs only locally and the port is not reachable from other hosts are less exposed. Other versions are not stated in the sources.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000668,"input_tokens":3398,"output_tokens":656,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116110':14A,17A '-2026':13A,16A '/livewallpaper/uploadfile':37B,80C '2.6.8.0':26B,68C 'access':11A 'address':125C 'affect':73C 'app':20B 'attack':45B,94C 'authent':8A,41B,92C 'b62f878899adbfc2968e3345442f3a3df91b774d':116C 'carri':99C 'check':42B 'compon':83C 'contact':131C 'could':109C 'credenti':53B 'cve':12A,15A 'desktop':19B 'desktop-app':18B 'disclosur':135C 'earli':132C 'enabl':9A 'endpoint':6A 'exploit':57B,103C 'expos':29B 'file':34B,79C 'file-upload':33B 'found':64C 'giantappman':24B,66C 'hub':32B,85C 'instal':121C 'issu':72C,127C 'lack':7A 'livewallpap':1A,21B,25B,67C 'made':106C 'manipul':88C 'miss':91C 'name':115C 'network':51B 'packag':22B 'patch':113C,123C 'path':36B 'perform':39B,86C 'possibl':96C 'process':76C 'public':56B,107C 'reach':47B 'releas':60B 'remot':10A,44B,101C 'result':89C 'signalr':4A,31B,84C 'suggest':119C 'unknown':75C 'upload':5A,35B 'use':111C 'vendor':129C 'vulner':62C 'window':3A,23B,28B,70C 'without':52B","nicknames":[],"mitigations":[],"who_affected":"Windows installations of GiantappMan LiveWallPaper version 2.6.8.0 that accept network connections to the SignalR hub. Machines where the app runs only locally and the port is not reachable from other hosts are less exposed. Other versions are not stated in the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T03:17:11+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116110","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116110","severity":null,"published_at":"2026-10-26T03:17:11+00:00","modified_at":"2026-10-26T03:17:11+00:00","first_seen_at":"2026-10-26T03:39:26+00:00","fetched_at":"2026-10-26T03:39:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}