Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.5
CVE-2026-55876: Helium planner lets uploaded SVG run scripts
CVE-2026-55876 · published 3 days ago
Summary
In Helium versions before 2.2.60, signed‑in users could upload SVG or HTML files that were not blocked. When someone opens the public link to that file, the embedded script runs, which could be used for phishing or other malicious actions. Upgrade Helium to version 2.2.60 or later to stop the unsafe file types from being accepted.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| heliumedu | platform | < 2.2.60 |
Original advisory text
Helium: Stored XSS via Unrestricted SVG File Upload — Authenticated Users Can Store Executable Scripts
Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, the POST /planner/attachments/ endpoint allows authenticated users to upload SVG and HTML attachments because conf/configs/common.py omits those formats from BLOCKED_ATTACHMENT_EXTENSIONS and BLOCKED_ATTACHMENT_MIME_TYPES, and helium/planner/serializers/attachmentserializer.py relies on those blocklists. An uploaded SVG served as image/svg+xml can execute embedded script when a visitor opens its public attachment URL, allowing persistent attacker-controlled active content and phishing under an application-managed storage URL. The attachment storage uses a separate origin from the application, so same-origin policy prevents the script from reading application cookies or storage, and application-session compromise is not supported by the maintained deployment configuration. This issue is fixed in version 2.2.60.
References
- https://github.com/HeliumEdu/platform/commit/f0de5c985c701942758b805a3d11dfb008a... Patch
- https://github.com/HeliumEdu/platform/security/advisories/GHSA-7r65-76fw-ch5c Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55876... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-55876 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published15 Oct 2026
Updated17 Oct 2026
First seen15 Oct 2026
Track software like this
Free during beta