CVE-2023-40502 is a critical flaw in LG Simple Editor 3.21.0: the cropImage method has a directory traversal bug that allows arbitrary file deletion. NVD scores it 9.1 (Critical). LG told the Zero Day Initiative it will not fix it, so no patch exists. Restrict access to the application or remove it.
What's affected
The record lists one product and one version: LG Simple Editor 3.21.0 (the CPE vendor field reads lg). The weakness class is CWE-22.
The vulnerable code is the cropImage method, which does not validate a user-supplied path before using it in a file operation, so an unauthenticated remote attacker can delete files. Deleting files as SYSTEM can break the application, the operating system or any service that depends on those files, so the practical result is loss of availability and integrity on the host.
No fixed version exists. The Zero Day Initiative advisory ZDI-23-1194 (tracked as ZDI-CAN-19951) says ZDI reported the issue to LG on 14 February 2023. On 8 August 2023 the vendor stated it does not plan to fix it now or in the future. ZDI then published it as a zero day advisory on 24 August 2023. NVD added the record on 3 May 2024. The record does not say whether versions other than 3.21.0 are affected, and the advisory names no safe version.
It is not in CISA's Known Exploited Vulnerabilities catalog, and the advisory does not say it is exploited in the wild.
Severity conflict to know about: NVD scores this 9.1 (Critical) with the vector in the record, while the ZDI advisory scores it 8.2. Both numbers describe the same flaw, and ZDI's lower score reflects a different integrity rating. Plan for the higher one.
How to check if you're exposed
There is no package feed to scan for this one, so exposure comes down to whether the application is installed and reachable. The record lists no authentication requirement, so network reachability is the only barrier.
On a Windows host, check whether LG Simple Editor is installed and which version:
Get-Package | Where-Object Name -like "*Simple Editor*"
Also look in Apps and features, because not every installer registers with that command. Then list listening sockets and match the owning process to the application:
netstat -ano | findstr LISTENING
tasklist /FI "PID eq 1234"
Replace 1234 with a process ID from the first command. If you find version 3.21.0 and the service answers from any network other than a trusted administration segment, treat the host as exposed. Add the host to your software inventory either way, so a later fix notice from LG reaches someone who can act on it.
What to do now
- Inventory every host that has LG Simple Editor installed and record the version.
- Remove network access you do not need. Block inbound connections to the service at the host firewall and the perimeter, and allow only named administrators.
- If the product is not in active use, uninstall it. With no vendor fix, retirement is the only complete remedy.
- Watch for unexpected file removals outside the application's own folders, and for requests to this method from addresses that are not your administrators.
- Ask LG whether a patched version or a replacement exists, and recheck the Zero Day Initiative advisory for updates.
Why it matters
Directory traversal happens when a program builds a file path from input it does not control and never checks where that path ends up. A value that was meant to name a file inside one folder can point anywhere the process is allowed to touch. Here the advisory says the process runs as SYSTEM, which on Windows is about as much authority as a local account gets.
Because the record shows no authentication and a network attack vector, the only barrier between the service and a stranger is network reachability. The deletion impact explains why the vector shows no confidentiality loss but high availability impact. The vendor has said it will not patch this, which is the main reason the guidance here is about reducing exposure.
This is one of many records filed against LG Simple Editor 3.21.0 from the same ZDI batch, each tied to a different method. Each bug stands alone, so the safest reading is that the product as a whole should stay off untrusted networks.
Quick check
Does this flaw let an attacker read files?
Not according to the record. The vector lists no confidentiality impact. It describes arbitrary file deletion, with integrity and availability affected.
Is a patch available for CVE-2023-40502?
No. According to the ZDI advisory, LG said on 8 August 2023 that it does not plan to fix the vulnerability. Check the advisory for later changes before you rely on that.
Sources
- Zero Day Initiative advisory ZDI-23-1194
- Safeguard Gold entry for CVE-2023-40502
- NVD record for CVE-2023-40502, as supplied in the Safeguard CVE dataset
Last reviewed: 19 October 2026.
