SimpleHelp Path Traversal Vulnerability

SimpleHelp SimpleHelp

SimpleHelp contains a path traversal vulnerability that allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user. Can be chained with CVE-2024-57726. Added to CISA KEV on 2026-04-24 (federal deadline 2026-05-08).

First seen: 24 Apr 2026
Last update: 24 Apr 2026, 12:00 UTC
Identifiers: CVE-2024-57726
CVE-2024-57728
Source: CISA KEV

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## SimpleHelp Path Traversal Vulnerability
Severity: critical, exploited in the wild. Patch status: patched.
Affected: SimpleHelp SimpleHelp
Ids: CVE-2024-57726, CVE-2024-57728

SimpleHelp contains a path traversal vulnerability that allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user. Can be chained with CVE-2024-57726. Added to CISA KEV on 2026-04-24 (federal deadline 2026-05-08).

## Steps
1. Search the repo, its CI and infra config for SimpleHelp SimpleHelp. If present, report the version in use and whether it's affected.

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2024-57726") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://nvd.nist.gov/vuln/detail/CVE-2024-57726 https://nvd.nist.gov/vuln/detail/CVE-2024-57728 https://simple-help.com/kb---security-vulnerabilities-01-2025#security-vulnerabilities-in-simplehelp-5-5-7-and-earlier
https://pwned.coffee/i/simplehelp-path-traversal-vulnerability

Sources

Totalone very hot coffee