---
id: "CVE-2026-116110"
kind: "vulnerability"
aliases: ["CVE-2026-116110"]
title: "LiveWallPaper for Windows: SignalR upload endpoint lacks authentication, enabling remote access"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["desktop-apps", "livewallpaper", "package", "windows"]
not_affected_if: ["local-only-binding"]
published_at: "2026-10-26T03:17:11+00:00"
first_seen_at: "2026-10-26T03:39:26+00:00"
updated_at: "2026-10-26T03:40:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116110", "first_seen_at": "2026-10-26T03:39:26+00:00"}]
---

# LiveWallPaper for Windows: SignalR upload endpoint lacks authentication, enabling remote access

GiantappMan LiveWallPaper 2.6.8.0 on Windows exposes a SignalR Hub file-upload path (/LiveWallpaper/UploadFile) that performs no authentication check. A remote attacker can reach it over the network without credentials, and a public exploit has been released.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed LiveWallPaper version on Windows; affected version is `2.6.8.0`
- Confirm whether the app's SignalR hub is reachable on the network (`unknown` port from sources)
- Look for requests to `/LiveWallpaper/UploadFile` in web or app logs

## Fix

- Install the patch referenced by the vendor, commit `b62f878899adbfc2968e3345442f3a3df91b774d`, or move to a release that includes it (version unknown from sources)
- Until patched, block network access to the LiveWallPaper port from untrusted networks

## Timeline

- 2026-10-26T03:39:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116110

## From the sources

A vulnerability was found in GiantappMan LiveWallPaper 2.6.8.0 on Windows. This issue affects some unknown processing of the file /LiveWallpaper/UploadFile of the component SignalR Hub. Performing a manipulation results in missing authentication. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The patch is named b62f878899adbfc2968e3345442f3a3df91b774d. It is suggested to install a patch to address this issue. The vendor was contacted early about this disclosure.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_