Overview
CVE-2026-116110 is a missing-authentication flaw (CWE-306) in GiantappMan LiveWallPaper 2.6.8.0 for Windows. It was published on 2026-10-26 after being reported through VulDB.
The issue sits in the /LiveWallpaper/UploadFile handler of the application's SignalR Hub component. Because the handler does not require authentication, a remote attacker can reach it directly.
Severity
| Metric | Value |
|---|---|
| CVSS 3.1 | 7.3 (High) |
| CVSS 4.0 | about 6.9 (Medium), per one tracker |
| Attack vector | Network, no authentication |
| Exploit status | Public proof-of-concept; not listed as known exploited |
Scores differ between trackers, so treat the flaw as high priority for any system running the affected build.
Impact
One secondary source reports that an unauthenticated attacker could upload a file through the hub and trigger it, resulting in arbitrary code execution. The primary advisory was not independently confirmed for that claim, so assume file upload at a minimum and plan for code execution.
Remediation
- A fix exists as upstream commit
b62f878899adbfc2968e3345442f3a3df91b774din the GiantappMan/livewallpaper repository (issue #185). One tracker lists no fixed release, so check the project for a build that includes the commit. - Uninstall or stop LiveWallPaper 2.6.8.0 on machines that do not need it.
- Block inbound access to the application's listening port at the host firewall; it should never be reachable from untrusted networks.
- Hunt for unexpected files written by the LiveWallPaper process.