Remote Code Execution Vulnerability in Helium Online Student Planner
CVE-2026-55876

3.5LOW

Key Information:

Vendor

Heliumedu

Status
Platform
Vendor
CVE Published:
15 October 2026

What is CVE-2026-55876?

Helium, a free online student planner, contains a vulnerability that allows authenticated users to upload SVG and HTML attachments through the /planner/attachments/ endpoint. Prior to version 2.2.60, the application improperly managed attachment formats due to insufficient filtering in its BLOCKED_ATTACHMENT_EXTENSIONS and BLOCKED_ATTACHMENT_MIME_TYPES settings. This oversight can enable an attacker to upload malicious SVG files containing executable scripts, which are triggered when the public URL of the attachment is accessed. Although the separate origin of the attachment storage mitigates the risk of JavaScript accessing application cookies or session data, the potential for persistent phishing attacks exists. This vulnerability has been addressed in the latest version.

Affected Version(s)

platform < 2.2.60

References

https://github.com/HeliumEdu/platform/security/advisories...
x_refsource_CONFIRM
https://github.com/HeliumEdu/platform/commit/f0de5c985c70...
x_refsource_MISC

CVSS V3.1

Score:
3.5
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.