Vulnerability record · CVE-2023-40496 · published 3 May 2024
CVE-2023-40496: LG Simple Editor copyStickerContent path traversal information disclosure
Lg · Simple Editor
LG Simple Editor fails to validate a user-supplied path in the copyStickerContent command, allowing directory traversal. A remote, unauthenticated attacker can read files outside the intended directory, exposing sensitive data on the host.
Description
LG Simple Editor copyStickerContent Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the copyStickerContent command. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. . Was ZDI-CAN-19923.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Automated analysis
high priorityUnauthenticated remote file disclosure with SYSTEM-level read access and very high EPSS, though no KEV listing or confirmed in-the-wild exploitation is provided.
What it is
LG Simple Editor fails to validate a user-supplied path in the copyStickerContent command, allowing directory traversal. A remote, unauthenticated attacker can read files outside the intended directory, exposing sensitive data on the host.
Impact
An attacker gains read access to arbitrary files in the context of SYSTEM, which can leak credentials, configuration and other sensitive data. There is no integrity or availability impact per the CVSS vector.
Attack surface
Reachable over the network via the copyStickerContent command with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The flaw is in path handling for file operations.
Exploitation
Not listed in CISA KEV and no public exploit reference is provided; EPSS is very high at 0.75653 (99.5th percentile), indicating elevated likelihood of exploitation activity.
What to do
- Apply the vendor patch for LG Simple Editor as soon as it is available; check LG security advisories for the fixed build.
- If patching is not possible, restrict network access to the Simple Editor service to trusted hosts only.
- Run the service with least privilege instead of SYSTEM to limit what a traversal read can expose.
- Monitor and block traversal patterns (../, encoded variants) at the web/proxy layer for this endpoint.
Detection
- Review Simple Editor and web server logs for copyStickerContent requests containing ../ or encoded traversal sequences.
- Alert on file read access outside expected editor directories, especially by the Simple Editor process account.
- Hunt for anomalous outbound or local reads of sensitive files (config, credential stores) by the editor service.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-23-1202/ | Third Party Advisory |
| https://www.zerodayinitiative.com/advisories/ZDI-23-1202/ | Third Party Advisory |
Track CVE-2023-40496 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2023-40496), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
