Vulnerability record · CVE-2023-40502 · published 3 May 2024
CVE-2023-40502: LG Simple Editor cropImage path traversal allows arbitrary file deletion
Lg · Simple Editor
LG Simple Editor fails to validate a user-supplied path in the cropImage command, allowing a directory traversal that deletes arbitrary files. The flaw is remotely reachable without authentication and executes in the SYSTEM context, so it can remove critical files and disrupt or disable the installation.
Description
LG Simple Editor cropImage Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary files on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the cropImage command. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete files in the context of SYSTEM. . Was ZDI-CAN-19951.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Automated analysis
critical priorityUnauthenticated remote arbitrary file deletion with SYSTEM privileges and a CVSS score of 9.1, combined with a very high EPSS probability, makes this a critical exposure.
What it is
LG Simple Editor fails to validate a user-supplied path in the cropImage command, allowing a directory traversal that deletes arbitrary files. The flaw is remotely reachable without authentication and executes in the SYSTEM context, so it can remove critical files and disrupt or disable the installation.
Impact
An unauthenticated remote attacker can delete arbitrary files with SYSTEM privileges, causing data loss, service disruption, or denial of service on the affected host.
Attack surface
Reachable over the network through the cropImage command with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N.
Exploitation
Not listed in CISA KEV and no public exploit references are tagged beyond the ZDI advisory, but EPSS is very high at 0.831 (99.7th percentile), indicating elevated likelihood of attempted exploitation.
What to do
- Apply the vendor patch for LG Simple Editor referenced by the ZDI advisory ZDI-23-1194 as soon as it is available.
- If no patch exists, restrict network access to the Simple Editor service to trusted hosts and block it from untrusted networks.
- Run the service under a low-privilege account rather than SYSTEM to limit the impact of file deletion.
- Monitor and back up critical files and configuration so deletions can be detected and restored.
- Validate or sanitize file paths in the cropImage command if any interim configuration or code control is possible.
Detection
- Monitor for unexpected deletion or disappearance of files, especially system and application files, on hosts running LG Simple Editor.
- Alert on cropImage command requests containing traversal sequences such as ../ or absolute paths.
- Review network logs for unauthenticated access to the Simple Editor service from unexpected sources.
- Correlate file deletion events with the Simple Editor process to identify malicious activity.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-23-1194/ | Third Party Advisory |
| https://www.zerodayinitiative.com/advisories/ZDI-23-1194/ | Third Party Advisory |
Track CVE-2023-40502 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2023-40502), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
