---
id: "CVE-2024-57727"
kind: "vulnerability"
aliases: ["CVE-2024-57727"]
title: "simple-help simplehelp: SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that\u2026"
severity: "critical"
cvss: 9.1
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "SimpleHelp SimpleHelp", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "simple-help simplehelp", "fixed": ["5.5.8"], "affected": "< 5.5.8", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "ransomware", "remote-support", "self-hosted", "simplehelp", "vendor"]
not_affected_if: ["not-running-simplehelp"]
published_at: "2025-01-15T23:15:09+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:05+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-57727", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57727", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# simple-help simplehelp: SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that…

SimpleHelp remote support software has path traversal flaws that let unauthenticated remote attackers download arbitrary files from the server. Downloaded files can include server configuration and hashed user passwords.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:SimpleHelp SimpleHelp affected ? fixed ?
- vendor:simple-help simplehelp affected < 5.5.8 fixed 5.5.8

## Fix

Apply the mitigations per the vendor instructions, or discontinue use of SimpleHelp if mitigations are unavailable (per CISA required action). Exact fixed version: unknown

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-57727
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2024-57727

## From the sources

SimpleHelp remote support software contains multiple path traversal vulnerabilities that allow unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files may include server configuration files and hashed user passwords.

CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_