← Vulnerability feed

Vulnerability record · CVE-2023-40508 · published 3 May 2024

CVE-2023-40508: Lg simple editor path traversal vulnerability

Lg · Simple Editor

LG Simple Editor putCanvasDB Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary files on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability. The specific flaw exists within the putCanvasDB method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete files in the context of SYSTEM. . Was ZDI-CAN-20010.

9.1 CVSS 3.1 Critical EPSS 2.0% · top 19.6% CWE-22 · Path traversal
9.1CVSS 3.1 base score
2.0%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

LG Simple Editor putCanvasDB Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary files on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability. The specific flaw exists within the putCanvasDB method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to delete files in the context of SYSTEM. . Was ZDI-CAN-20010.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.zerodayinitiative.com/advisories/ZDI-23-1212/ Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-23-1212/ Third Party Advisory

Track CVE-2023-40508 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-40504LG Simple Editor readVideoInfo command injection RCELG Simple Editor contains an OS command injection flaw in the readVideoInfo method, where a user-supplied string is passed to a system call without v…EPSS 89%analysed9.8CVE-2023-40505Lg simple editor os command injection vulnerabilityLG Simple Editor createThumbnailByMovie Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute …EPSS 2.4%9.8CVE-2023-40498LG Simple Editor cp command path traversal allows remote code executionLG Simple Editor fails to validate a user-supplied path before passing it to the cp command inside the makeDetailContent method, allowing directory t…EPSS 85%analysed9.8CVE-2023-40500Lg simple editor vulnerabilityLG Simple Editor copyContent Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute ar…EPSS 1.9%9.8CVE-2023-40501Lg simple editor vulnerabilityLG Simple Editor copyContent Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute ar…EPSS 1.9%9.8CVE-2023-40493Lg simple editor path traversal vulnerabilityLG Simple Editor copySessionFolder Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arb…EPSS 2.9%9.8CVE-2023-40497LG Simple Editor saveXml path traversal leads to remote code executionLG Simple Editor fails to validate a user-supplied path in the saveXml command implemented in the makeDetailContent method, allowing directory traver…EPSS 69%analysed9.1CVE-2023-40509Lg simple editor path traversal vulnerabilityLG Simple Editor deleteCanvas Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitra…EPSS 2.0%

Source: NIST National Vulnerability Database (record CVE-2023-40508), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.