CVE-2026-55876 Details
Description
Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, the POST /planner/attachments/ endpoint allows authenticated users to upload SVG and HTML attachments because conf/configs/common.py omits those formats from BLOCKED_ATTACHMENT_EXTENSIONS and BLOCKED_ATTACHMENT_MIME_TYPES, and helium/planner/serializers/attachmentserializer.py relies on those blocklists. An uploaded SVG served as image/svg+xml can execute embedded script when a visitor opens its public attachment URL, allowing persistent attacker-controlled active content and phishing under an application-managed storage URL. The attachment storage uses a separate origin from the application, so same-origin policy prevents the script from reading application cookies or storage, and application-session compromise is not supported by the maintained deployment configuration. This issue is fixed in version 2.2.60.
A stored cross-site scripting vulnerability has been identified in Helium, an online student planner, in versions through 2.2.59. The issue arises from the application's file attachment upload endpoint, which allows authenticated users to upload SVG files. This vulnerability exists because the application's configuration files do not block SVG or HTML file types, enabling the upload of malicious content that can execute scripts when the file is accessed publicly. Although the injected script cannot access the application's cookies or storage due to same-origin policy restrictions, the vulnerability still poses a risk by allowing the execution of scripts in the context of the user's browser.
Users can update to Helium version 2.2.60, which addresses this vulnerability by adding SVG and HTML file types to the blocklist and serving user-uploaded files from a separate origin that is not in the application's same-origin group.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 15, 2026CISA-ADP
Assessed Oct 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/HeliumEdu/platform/security/advisories/GHSA-7r65-76fw-ch5c | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/HeliumEdu/platform/commit/f0de5c985c701942758b805a3d11dfb008a6af88 | [email protected] | Source CodeVendor |
| https://github.com/HeliumEdu/platform/security/advisories/GHSA-7r65-76fw-ch5c | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| HeliumEdu/platform | <= 2.2.59 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 21, 2026 | CVE Modified | CISA-ADP |
| Oct 15, 2026 | New CVE Received | [email protected] |