High severity · published Oct 26, 2026
CVE-2026-116110
GiantappMan LiveWallPaper SignalR Hub UploadFile missing authentication
New
7.3
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability was found in GiantappMan LiveWallPaper 2.6.8.0 on Windows. This issue affects some unknown processing of the file /LiveWallpaper/UploadFile of the component SignalR Hub. Performing a manipulation results in missing authentication. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The patch is named b62f878899adbfc2968e3345442f3a3df91b774d. It is suggested to install a patch to address this issue. The vendor was contacted early about this disclosure.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
LiveWallPaper · GiantappMan
2.6.8.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-116110
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-116110
github.com
https://github.com/GiantappMan/livewallpaper/
github.com
https://github.com/GiantappMan/livewallpaper/commit/b62f878899adbfc2968e3345442f3a3df91b774d
github.com
https://github.com/GiantappMan/livewallpaper/issues/185
jfyuhong.github.io
https://jfyuhong.github.io/advisories/livewallpaper-2.6.8.0/
vuldb.com
https://vuldb.com/cve/CVE-2026-116110
vuldb.com
https://vuldb.com/submit/1003156