CVE-2023-40498: LG Simple Editor cp command path traversal allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable code execution as SYSTEM with a CVSS of 9.8 and very high EPSS makes this an urgent remediation target.

What it is

LG Simple Editor fails to validate a user-supplied path before passing it to the cp command inside the makeDetailContent method, allowing directory traversal. Because the flaw is reachable without authentication and leads to code execution as SYSTEM, it is a severe pre-auth remote code execution issue for exposed installations.

Impact

An unauthenticated remote attacker can execute arbitrary code with SYSTEM privileges on the affected LG Simple Editor installation, giving full control of the host.

Attack surface

The vulnerability is network-reachable (AV:N) with no authentication (PR:N) and no user interaction (UI:N) required, per the CVSS vector and description. Any network-exposed instance of the affected product is potentially reachable.

Exploitation

Not listed in CISA KEV and no public exploit references are provided beyond the ZDI advisory, but EPSS is very high (0.8509, 99.7th percentile), indicating elevated likelihood of exploitation activity.

What to do

• Apply the vendor patch or fixed build for LG Simple Editor as soon as it is available; this is the primary remediation.
• Remove or restrict network exposure of LG Simple Editor to trusted networks only; do not leave it internet-facing.
• Run the service under a low-privileged account rather than SYSTEM to limit post-exploitation impact.
• Monitor vendor advisories and the ZDI advisory (ZDI-23-1204) for updated fixed-version guidance.

Detection

• Monitor for unexpected cp command invocations or file operations originating from the Simple Editor process, especially with traversal sequences in paths.
• Alert on anomalous child processes or command execution spawned by the Simple Editor service.
• Review web/application logs for requests to the makeDetailContent functionality containing path traversal patterns (../).
• Watch for new or modified files outside expected editor directories that could indicate dropped payloads.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.