SimpleHelp remote support software versions 5.5.7 and before contain a directory traversal vulnerability (CWE-22) via zip slip when processing uploaded zip files by admin users. This flaw allows an attacker with administrative privileges to write arbitrary files anywhere on the host file system, potentially leading to arbitrary code execution under the SimpleHelp server user context. The vulnerability is remotely exploitable over the network with low attack complexity but requires high privileges (admin). No vendor advisory or patch information is currently provided.

Successful exploitation allows an attacker with administrative access to upload crafted zip files that write arbitrary files to any location on the file system, enabling arbitrary code execution as the SimpleHelp server user. This can compromise the confidentiality, integrity, and availability of the affected system. The CVSS score of 7.2 reflects high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative access to trusted users only and monitor for suspicious activity related to file uploads. Avoid uploading zip files from untrusted sources. No official patch or temporary fix has been announced at this time.