SimpleHelp remote support software versions 5.5.7 and before contain a directory traversal (zip slip) vulnerability (CWE-22) that allows authenticated admin users to upload specially crafted zip files. This flaw permits arbitrary file write operations anywhere on the host file system, potentially leading to arbitrary code execution under the SimpleHelp server user context. The vulnerability is remotely exploitable over the network with low attack complexity but requires administrative privileges. The CVSS 3.1 score is 7.2 (High). No patch or official remediation has been disclosed as of the publication date.

Successful exploitation allows an attacker with administrative access to the SimpleHelp server to write arbitrary files anywhere on the file system, which can lead to arbitrary code execution with the privileges of the SimpleHelp server user. This can compromise the confidentiality, integrity, and availability of the affected system. No known public exploits or active exploitation have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative access to trusted personnel only and monitor for suspicious activity related to file uploads. Avoid uploading untrusted zip files. Follow vendor communications closely for updates on patches or official mitigations.