CVE-2026-55875
Received Received - Intake

Open Redirect and SSRF in Helium Student Planner

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description
Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, any authenticated user can submit an arbitrary URL to POST /feed/externalcalendars/, where helium/feed/services/icalexternalcalendarservice.py uses validate_url to check only URL syntax before passing the value to urllib.request.urlopen, and fetch_ical_conditional periodically refetches the stored URL. The server can therefore issue requests to attacker-selected external or internal hosts, while distinct responses, including an uncaught http.client.RemoteDisconnected condition for non-HTTP services, reveal internal host and port reachability. The supported impact is forced outbound requests and internal service reconnaissance; the advisory does not demonstrate secret retrieval because the relevant ECS credentials path is task-specific and unpredictable. This issue is fixed in version 2.2.60.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-16
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-55875
EUVD
EUVD-2026-102222

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
HeliumEdu platform < 2.2.60

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-55875 is a Server-Side Request Forgery (SSRF) vulnerability in the HeliumEdu platform. It allows authenticated users to submit arbitrary URLs to the server, which then makes HTTP requests to those URLs without proper validation. The server does not restrict requests to private or internal IP ranges, enabling attackers to probe internal services like databases or cloud metadata endpoints. The vulnerability also leaks internal host and port information through error responses.

Detection Guidance

To detect this SSRF vulnerability, monitor outbound HTTP requests from your HeliumEdu server, especially POST requests to /feed/externalcalendars/. Check for requests to internal IPs or unexpected external domains. Review server logs for urllib.request.urlopen calls without proper URL validation. Use network traffic analysis tools like tcpdump or Wireshark to inspect outbound connections from the server.

Impact Analysis

This vulnerability can lead to forced outbound requests to attacker-selected hosts, internal service reconnaissance, and port scanning. In cloud environments like AWS ECS, attackers may probe the container-credentials endpoint to potentially steal IAM role credentials, which could then be used to access other AWS services depending on the permissions granted.

Mitigation Strategies

Immediately upgrade to HeliumEdu version 2.2.60 or later to apply the SSRF fix. If upgrading is not possible, implement network-level restrictions to block outbound requests to private IP ranges. Disable the /feed/externalcalendars/ endpoint if unused. Monitor for unusual outbound traffic patterns and restrict user permissions to reduce attack surface.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55875. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart