Vulnerability record · CVE-2023-40494 · published 3 May 2024
CVE-2023-40494: LG Simple Editor deleteFolder path traversal allows arbitrary file deletion
Lg · Simple Editor
LG Simple Editor's deleteFolder method fails to validate a user-supplied path before using it in file operations, allowing directory traversal. A remote, unauthenticated attacker can delete arbitrary files on affected installations, and the deletion occurs in the SYSTEM context.
Description
LG Simple Editor deleteFolder Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary files on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability. The specific flaw exists within the deleteFolder method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete files in the context of SYSTEM. . Was ZDI-CAN-19921.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Automated analysis
critical priorityCVSS 9.1 with network reachability, no authentication, and high integrity and availability impact, plus a very high EPSS score, make this an urgent fix despite no KEV listing.
What it is
LG Simple Editor's deleteFolder method fails to validate a user-supplied path before using it in file operations, allowing directory traversal. A remote, unauthenticated attacker can delete arbitrary files on affected installations, and the deletion occurs in the SYSTEM context.
Impact
An attacker gains the ability to delete arbitrary files with SYSTEM privileges, which can break the application or the host and may enable further attacks such as denial of service or removal of security-relevant files.
Attack surface
Reachable over the network via the deleteFolder method with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N.
Exploitation
Not listed in CISA KEV, but EPSS is very high at 0.831 (99.7th percentile); the only references are ZDI third-party advisories, so no public exploit code is confirmed by this record.
What to do
- Apply the vendor patch or fixed version for LG Simple Editor as soon as it is available.
- If no patch exists, restrict network access to LG Simple Editor to trusted hosts only.
- Run the application with least privilege rather than SYSTEM to limit the impact of file deletion.
- Monitor and back up critical files so deleted data can be restored.
- Remove or disable the product if it cannot be patched or isolated.
Detection
- Monitor for unexpected deletion of files in application and system directories on hosts running LG Simple Editor.
- Alert on deleteFolder requests containing traversal sequences such as ../ or encoded variants in logs or network traffic.
- Watch for anomalous file-deletion activity by the LG Simple Editor process, especially outside its expected data directories.
- Correlate file deletion events with inbound network connections to the LG Simple Editor service.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-23-1200/ | Third Party Advisory |
| https://www.zerodayinitiative.com/advisories/ZDI-23-1200/ | Third Party Advisory |
Track CVE-2023-40494 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2023-40494), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
