CVE-2024-57728

SimpleHelp remote support software version 5.5.7 and earlier contains a path traversal flaw (zip slip, CWE-22/CWE-59) in its file upload feature, which fails to properly validate file paths inside uploaded ZIP archives. An authenticated admin user can upload a crafted ZIP file whose archive entries use traversal paths, causing files to be written anywhere on the SimpleHelp server's file system outside the intended upload directory. By placing files at attacker-chosen locations on the host, the attacker achieves arbitrary code execution in the context of the SimpleHelp server user account. Any organization running an affected SimpleHelp server is exposed, with MSPs at particular risk because the product is used as RMM software — attackers (including ransomware groups such as DragonForce and Storm-1175 operators) have chained SimpleHelp flaws to compromise an MSP and push ransomware to its downstream customers. The flaw is confirmed exploited in the wild: CISA added it to the KEV catalog on 2026-04-24 with known ransomware use, EPSS puts 30-day exploitation probability at 7% (94th percentile), and no public proof-of-concept is known.

What to do: Upgrade SimpleHelp to a release later than 5.5.7 per vendor instructions; federal agencies under BOD 22-01 must apply vendor mitigations, follow cloud-service guidance, or discontinue use of the product if mitigations are unavailable. Given known ransomware abuse via chained SimpleHelp flaws, MSPs and other operators should check SimpleHelp server logs for unexpected admin uploads and logins, look for unexpected files or services on the SimpleHelp host, and hunt for signs of lateral movement or ransomware staging on connected client machines.