LiveWallPaper EUVD-2026-109602

The LiveWallpaper 2.6.8.0 LocalServer must be running on the Windows host and its SignalR hub /LiveWallpaper/UploadFile endpoint must be reachable by the attacker; because the endpoint has missing authentication (CWE-306, PR:N) no credentials or user interaction are required against a default install. The limiting factor is network reachability: the component is a local server, so whether a remote attacker can reach it depends on the listener binding to a non-loopback interface (not confirmed in the sources) rather than being restricted to localhost. Pre-patch, exploitation also relies on the absence of path-normalization and extension filtering - the fix adds SecurityGuard.IsPathUnderDir checks and blocks executable extensions, so a patched instance removes the file-escape and executable-upload conditions.

The input assigns CVSS 4.0 base score 6.9 (medium) with a fully remote, unauthenticated vector (AV:N/AC:L/AT:N/PR:N/UI:N) but only low impact across all three dimensions (VC:L/VI:L/VA:L), and the threat metric E:P marks exploit maturity as proof-of-concept rather than functional. No EPSS score and no CISA KEV entry are present in the input, so there is no signal of widespread or confirmed active exploitation; the vuln.today decision label is 'this_month', indicating a schedulable rather than emergency priority. The attack vector is marked AV:N and the description states remote exploitation is possible, but the component is LiveWallpaper's LocalServer SignalR hub - whether it is reachable off-host depends on whether the listener binds beyond loopback, which the available sources do not confirm; verify the bind address before treating this as internet-reachable. The source diff confirms the fix hardens /LiveWallpaper/UploadFile against directory escape (..\ traversal and same-prefix bypass) and blocks executable file extensions, so pre-patch the missing-authentication flaw (CWE-306) allowed unauthenticated file write outside the wallpaper directory, which is consistent with the low-but-nonzero integrity/availability impact. Net: a real but modest-priority issue in a niche product - not a high-CVSS/low-real-risk mismatch, but also not an emergency given low impact, PoC-only maturity, and no KEV/EPSS escalation.

An attacker able to reach the LiveWallpaper LocalServer SignalR hub sends a crafted multipart upload to /LiveWallpaper/UploadFile without any authentication (CWE-306), using a manipulated filename to write a file outside the intended wallpaper directory on the Windows host. A public PoC reference exists (jfyuhong advisory) but it is not verified as working exploit code, and CVSS attack complexity is low (AC:L) with no user interaction required. Impact is limited (VC:L/VI:L/VA:L), so the realistic outcome is unauthorized file write/overwrite rather than direct high-privilege code execution.