What’s Vulnerable › Vulnerabilities

CVE-2024-57727: SimpleHelp Path Traversal Vulnerability

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2025-02-13
• EPSS: 96.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-01-15 · updated 2026-08-04
• Weakness: CWE-22

Description

SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files include server configuration files containing various secrets and hashed user passwords.

Affected products

• Simplehelp: before 5.5.8 — fixed in 5.5.8

How to fix

Upgrade to a fixed version: Simplehelp 5.5.8. Check the vendor advisory for mitigations.

References

• https://simple-help.com/kb---security-vulnerabilities-01-2025#security-vulnerabilities-in-simplehelp-5-5-7-and-earlier
• https://www.horizon3.ai/attack-research/disclosures/critical-vulnerabilities-in-simplehelp-remote-support-software/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-57727

Get alerted when CVE-2024-57727 or the next vulnerability affects your stack