CVE-2026-55876 in Helium
Summary
by MITRE • 10/15/2026
Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, the POST /planner/attachments/ endpoint allows authenticated users to upload SVG and HTML attachments because conf/configs/common.py omits those formats from BLOCKED_ATTACHMENT_EXTENSIONS and BLOCKED_ATTACHMENT_MIME_TYPES, and helium/planner/serializers/attachmentserializer.py relies on those blocklists. An uploaded SVG served as image/svg+xml can execute embedded script when a visitor opens its public attachment URL, allowing persistent attacker-controlled active content and phishing under an application-managed storage URL. The attachment storage uses a separate origin from the application, so same-origin policy prevents the script from reading application cookies or storage, and application-session compromise is not supported by the maintained deployment configuration. This issue is fixed in version 2.2.60.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified involves Helium, an online student planner application designed to manage classes, homework, grades, and notes through a web-based interface. The core technical flaw resides within the file attachment handling mechanism, specifically affecting versions prior to 2.2.60. The system utilizes two primary configuration files for security enforcement: conf/configs/common.py and helium/planner/serializers/attachmentserializer.py. These components are responsible for validating uploaded content by checking it against predefined blocklists of forbidden file extensions and MIME types. However, the implementation fails to include SVG (Scalable Vector Graphics) and HTML formats in these BLOCKED_ATTACHMENT_EXTENSIONS and BLOCKED_ATTACHMENT_MIME_TYPES lists. This omission allows authenticated users to bypass standard security filters and upload files with dangerous executable content capabilities directly into the application's storage infrastructure.
From a technical perspective, this represents an insufficient input validation vulnerability where specific file types are not adequately restricted despite their potential for malicious execution. When an attacker uploads an SVG or HTML file, the server accepts it without stripping embedded scripts because the MIME type image/svg+xml is permitted by default configuration settings. Once stored, these files can be accessed via public attachment URLs generated by the application. If a victim user opens such a URL in a web browser that supports script execution within SVG elements, the embedded JavaScript code will execute immediately. This behavior transforms what appears to be static media into active content capable of performing arbitrary actions on behalf of the viewer, effectively creating a stored cross-site scripting vector through rich media formats rather than traditional HTML input fields.
The operational impact of this vulnerability is significant due to its persistent nature and potential for social engineering attacks. Because the uploaded files are served from public URLs managed by the application infrastructure, an attacker can craft malicious SVG or HTML payloads that mimic legitimate Helium interface elements or contain deceptive content designed to harvest credentials. This facilitates phishing campaigns where victims believe they are interacting with a trusted educational platform component. The persistence of the payload means that any user who views the compromised attachment URL is exposed to risk without requiring further interaction from the attacker, making it particularly dangerous in collaborative environments where students and teachers frequently share resources.
Despite these risks, certain architectural mitigations inherent to Helium's deployment model limit the severity of potential exploitation. The application employs a separate origin for its attachment storage compared to the main application domain. This separation enforces browser same-origin policies which prevent scripts executed within the uploaded SVG or HTML files from accessing cookies, local storage, or other sensitive data belonging to the primary Helium application session. Consequently, while an attacker can execute active content and potentially trick users into revealing information through phishing techniques, they cannot directly hijack user sessions or steal authentication tokens via this specific vector under standard maintained deployment configurations. This isolation significantly reduces the likelihood of full account compromise but does not eliminate the risk of credential theft through deceptive UI manipulation.
To address this issue, it is imperative to update Helium to version 2.2.60 or later where these blocklists have been corrected to explicitly deny SVG and HTML formats in both extension and MIME type checks. For organizations still running older versions, immediate mitigation requires implementing a reverse proxy rule or web application firewall policy that blocks requests containing image/svg+xml or text/html content types at the attachment upload endpoint. Additionally, developers should adopt a whitelist approach for allowed file attachments rather than relying solely on blacklist mechanisms to prevent future oversights regarding new dangerous formats. This vulnerability is categorized under CWE-20 Improper Input Validation and aligns with MITRE ATT&CK technique T1566.002 Spearphishing Link, as it enables the delivery of malicious content disguised as legitimate application assets to facilitate credential harvesting or further exploitation attempts.