HeliumEdu vulnerabilities

Products

• platform 2

Latest HeliumEdu CVEs

Newest publication first

1. CVE-2026-55875 Helium: SSRF via External Calendar URL Allows Authenticated Users to Probe Internal Network

   Published 2026-10-15

   Medium·CVSS 4.3 EPSS 0.21%

   Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, any authenticated user can submit an arbitrary URL to POST /feed/externalcalendars/, where helium/feed/services/icalexternalcalendarservice.py uses validate_url to check only URL sy...

2. CVE-2026-55876 Helium: Stored XSS via Unrestricted SVG File Upload — Authenticated Users Can Store Executable Scripts

   Published 2026-10-15

   Low·CVSS 3.5 EPSS 0.18%

   Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, the POST /planner/attachments/ endpoint allows authenticated users to upload SVG and HTML attachments because conf/configs/common.py omits those formats from BLOCKED_ATTACHMENT_EXTE...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.