CVE-2026-55875

Helium, a student planner, is vulnerable to Server-Side Request Forgery (SSRF) in versions prior to 2.2.60 . An authenticated user can submit an arbitrary URL to the POST /feed/externalcalendars/ endpoint. The application's icalexternalcalendarservice.py script validates only the URL syntax befor...

CVE-2026-55875 Helium: SSRF via External Calendar URL Allows Authenticated Users to Probe Internal Network

Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, any authenticated user can submit an arbitrary URL to POST /feed/externalcalendars/, where helium/feed/services/icalexternalcalendarservice.py uses validateurl to check only URL syntax before passin...