CVE-2026-55876

The Helium student planner (prior to version 2.2.60 ) is vulnerable to Stored XSS via the POST /planner/attachments/ endpoint. The root cause is that conf/configs/common.py fails to include SVG and HTML formats in the BLOCKED_ATTACHMENT_EXTENSIONS and BLOCKED_ATTACHMENT_MIME_TYPES lists, which th...