CVE-2024-57727 SimpleHelp Path Traversal

What is CVE-2024-57727?

CVE-2024-57727 is a critical path traversal vulnerability in n/a, published on 15 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files include server configuration files containing various secrets and hashed user passwords.

Weakness: CWE-22

Which versions are affected by CVE-2024-57727?

It affects 1 product.

Products include Simple-Help Simplehelp.

How do I fix CVE-2024-57727?

No fix has been published for CVE-2024-57727 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 6 Mar 2025.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2024-57727 being exploited?

Yes. Attackers have exploited CVE-2024-57727 in the wild since at least 13 Feb 2025, including in ransomware campaigns.

Public exploit code: 1 Metasploit module, 1 Nuclei template and 1 proofs of concept on GitHub.

Other vulnerabilities in n/a

• CVE-2024-57726 SimpleHelp Missing Authorization Exploited Critical 9.9
• CVE-2026-48558 SimpleHelp Authentication Bypass Exploited Critical 9.5
• CVE-2024-57728 SimpleHelp Path Traversal Exploited High 7.2
• CVE-2025-36727 SimpleHelp Inclusion of functionality from untrusted control sphere High 8.3
• CVE-2025-36728 SimpleHelp Cross Site Request Forgery Medium 6.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-x84r-h282-g729.