CVE-2026-55875

Helium, a student planner, is vulnerable to Server-Side Request Forgery (SSRF) in versions prior to 2.2.60 . An authenticated user can submit an arbitrary URL to the POST /feed/externalcalendars/ endpoint. The application's icalexternalcalendarservice.py script validates only the URL syntax befor...