CVE-2023-40492: LG Simple Editor deleteCheckSession path traversal allows arbitrary file deletion

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.1 with no authentication or user interaction required and a very high EPSS score make this a critical remote file-deletion risk.

What it is

LG Simple Editor contains a path traversal flaw in the deleteCheckSession method, where a user-supplied path is used in file operations without proper validation. Because authentication is not required, a remote attacker can reach the method and delete arbitrary files. This matters because file deletion runs in the SYSTEM context, so the flaw can remove critical files and disrupt or damage the installation.

Impact

An attacker gains the ability to delete arbitrary files with SYSTEM privileges, which can break the application or operating system and cause denial of service. The CVSS vector shows no confidentiality loss but high integrity and availability impact.

Attack surface

The vulnerability is network-reachable (AV:N) with no privileges or user interaction required (PR:N, UI:N), so it can be triggered directly against the deleteCheckSession method. No authentication is needed per the description.

Exploitation

The record does not list this CVE in CISA KEV and documents no ransomware use; EPSS is very high at 0.83142 (99.659th percentile), indicating strong predicted exploitation likelihood, though the only references are ZDI advisories with no exploit tag.

What to do

• Apply the vendor patch or fixed LG Simple Editor release as soon as one is available; check LG security advisories for the corrected version.
• If no patch exists, restrict network access to the Simple Editor service to trusted hosts and block it from untrusted networks.
• Run the service under a low-privilege account instead of SYSTEM to limit the impact of arbitrary file deletion.
• Monitor and back up critical files so deleted data can be restored quickly.
• Validate or sanitize any user-supplied path input reaching deleteCheckSession if the application can be modified.

Detection

• Monitor for unexpected deletion or disappearance of files in LG Simple Editor installation and system directories.
• Alert on requests to the deleteCheckSession endpoint or method, especially from untrusted source IPs.
• Watch for file-system events where the Simple Editor process deletes files outside its expected working directories.
• Correlate process-level file deletion activity by the Simple Editor service with inbound network connections.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.