CVE-2026-55875 Details
Description
Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, any authenticated user can submit an arbitrary URL to POST /feed/externalcalendars/, where helium/feed/services/icalexternalcalendarservice.py uses validate_url to check only URL syntax before passing the value to urllib.request.urlopen, and fetch_ical_conditional periodically refetches the stored URL. The server can therefore issue requests to attacker-selected external or internal hosts, while distinct responses, including an uncaught http.client.RemoteDisconnected condition for non-HTTP services, reveal internal host and port reachability. The supported impact is forced outbound requests and internal service reconnaissance; the advisory does not demonstrate secret retrieval because the relevant ECS credentials path is task-specific and unpredictable. This issue is fixed in version 2.2.60.
A server-side request forgery (SSRF) vulnerability has been identified in Helium, a free online student planner, in versions prior to 2.2.60. This vulnerability allows any authenticated user to submit an arbitrary URL, which the server then fetches without proper validation of the URL's reachability or privacy status. The issue arises in the 'icalexternalcalendarservice.py' file, where the 'validate_url' function only checks URL syntax before passing it to 'urllib.request.urlopen'. As a result, the server can make requests to attacker-controlled external hosts or internal services that are otherwise inaccessible, potentially leading to unauthorized probing of internal networks and services.
Users can update to Helium version 2.2.60 or later, where this vulnerability has been fixed. The update includes a proper validation of URLs to block private and reserved IP ranges, and catches exceptions that could lead to unhandled server errors.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/HeliumEdu/platform/security/advisories/GHSA-2f83-94pv-v3f5 | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/HeliumEdu/platform/commit/f0de5c985c701942758b805a3d11dfb008a6af88 | [email protected] | Source CodeVendor |
| https://github.com/HeliumEdu/platform/security/advisories/GHSA-2f83-94pv-v3f5 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| HeliumEdu/platform | <= 2.2.59 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | New CVE Received | [email protected] |
| Oct 15, 2026 | CVE Modified | CISA-ADP |