{"id":"CVE-2024-57728","kind":"vulnerability","aliases":["CVE-2024-57728"],"related":[],"title":"simple-help simplehelp: SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the…","description":"SimpleHelp contains a path traversal vulnerability that allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"SimpleHelp, a remote support tool, has a zip slip path traversal bug that lets an admin user write files anywhere on the server. An attacker can use it to execute arbitrary code on the host as the SimpleHelp server user.","severity":"high","cvss":7.2,"epss":null,"exploited":true,"exploited_at":"2026-04-24T00:00:00+00:00","products":[{"name":"SimpleHelp SimpleHelp","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"simple-help simplehelp","fixed":["5.5.8"],"affected":"< 5.5.8","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","other","ransomware","remote-support","self-hosted","simplehelp"],"not_affected_if":["no-simplehelp-deployment"],"how_to_check":null,"fix":"Apply the vendor mitigation per CISA KEV guidance; the specific patched version is unknown from the sources. If no mitigation is available, discontinue use of the product.","status":"open","published_at":"2025-01-15T23:15:09+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:38:41+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-23T20:38:41Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigation per CISA KEV guidance; the specific patched version is unknown from the sources. If no mitigation is available, discontinue use of the product.","reach":"unknown","summary":"SimpleHelp, a remote support tool, has a zip slip path traversal bug that lets an admin user write files anywhere on the server. An attacker can use it to execute arbitrary code on the host as the SimpleHelp server user.","category":"other","who_cares":["simplehelp","self-hosted","remote-support"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker runs arbitrary code on the SimpleHelp server as its service user.","analyst_note":"Find the SimpleHelp vendor advisory for the affected and fixed versions and the exact mitigation steps, and check the file-upload and admin-panel paths to build a how-to-check.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-simplehelp-deployment"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000449,"input_tokens":2587,"output_tokens":381,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':141C '-2024':21A,24A '-57728':22A,25A '22':140C 'action':131C 'admin':13A,57B,90C 'allow':12A,89C 'anywher':19A,61B,96C 'appli':132C 'applic':138C 'arbitrari':17A,72B,94C,116C 'attack':66B 'bod':139C 'bug':53B 'cisa':129C 'cloud':144C 'code':73B,117C 'contain':83C 'context':123C 'craft':104C 'cve':20A,23A 'discontinu':147C 'execut':71B,115C 'exploit':32B,113C 'file':18A,60B,95C,99C,106C 'follow':137C 'guidanc':142C 'help':3A,30A 'host':40B,76B,120C 'i.e':107C 'instruct':136C 'let':55B 'mitig':133C,153C 'path':51B,85C 'per':134C 'product':151C 'ransomwar':34B 'remot':6A,36B,44B 'remote-support':35B 'requir':130C 'self':39B 'self-host':38B 'server':64B,80B,127C 'servic':145C 'simpl':2A 'simple':29A 'simple-help':1A,28A 'simplehelp':4A,5A,26A,27A,31A,41B,42B,79B,82C,126C 'slip':50B,109C 'softwar':8A 'support':7A,37B,45B 'system':100C 'tool':46B 'travers':52B,86C 'unavail':155C 'upload':16A,93C,102C 'use':68B,148C 'user':14A,58B,81B,91C,128C 'v5.5.7':9A 'vendor':135C 'vulner':87C 'write':59B 'zip':49B,105C,108C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-01-15T23:15:09+00:00","kev":{"dateAdded":"2026-04-24","dueDate":"2026-05-08","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2024-57728","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-57728","severity":null,"published_at":"2026-04-24T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T19:35:19+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-57728","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57728","severity":null,"published_at":"2025-01-15T23:15:09+00:00","modified_at":"2026-06-17T08:13:58+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}