Arbitrary URL Submission Flaw in Helium Student Planner by HeliumEdu
CVE-2026-55875

4.3MEDIUM

Key Information:

Vendor

Heliumedu

Status
Platform
Vendor
CVE Published:
15 October 2026

What is CVE-2026-55875?

Prior to version 2.2.60, Helium, a free online student planner, allows authenticated users to submit arbitrary URLs via the POST request to /feed/externalcalendars/. The Helium application only validates the syntax of the URL before utilizing urllib.request.urlopen, leading to security concerns. This vulnerability enables the server to make requests to attacker-defined external or internal hosts, which could facilitate internal service enumeration. The application does not capture sensitive information as the context of retrieval is specific to task parameters, but potential forced outbound requests pose a significant risk. This issue is resolved in version 2.2.60.

Affected Version(s)

platform < 2.2.60

References

https://github.com/HeliumEdu/platform/security/advisories...
x_refsource_CONFIRM
https://github.com/HeliumEdu/platform/commit/f0de5c985c70...
x_refsource_MISC

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.