CVE-2026-55876
Received Received - Intake

Stored XSS via SVG Upload in Helium Student Planner

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description
Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, the POST /planner/attachments/ endpoint allows authenticated users to upload SVG and HTML attachments because conf/configs/common.py omits those formats from BLOCKED_ATTACHMENT_EXTENSIONS and BLOCKED_ATTACHMENT_MIME_TYPES, and helium/planner/serializers/attachmentserializer.py relies on those blocklists. An uploaded SVG served as image/svg+xml can execute embedded script when a visitor opens its public attachment URL, allowing persistent attacker-controlled active content and phishing under an application-managed storage URL. The attachment storage uses a separate origin from the application, so same-origin policy prevents the script from reading application cookies or storage, and application-session compromise is not supported by the maintained deployment configuration. This issue is fixed in version 2.2.60.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-16
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-55876
EUVD
EUVD-2026-102221

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
HeliumEdu platform < 2.2.60

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-55876 is a stored Cross-Site Scripting (XSS) vulnerability in the HeliumEdu platform affecting versions up to 2.2.59. The issue allows authenticated users to upload SVG files via the /planner/attachments/ endpoint because the application does not block these file types. SVG files can contain embedded JavaScript that executes when opened in a browser, enabling persistent XSS attacks where malicious payloads remain stored on the server.

Detection Guidance

Check for uploaded SVG or HTML files in the /planner/attachments/ directory. Review server logs for POST requests to this endpoint with suspicious file extensions. Use tools like curl to inspect response headers for Content-Type: image/svg+xml on attachment URLs.

Impact Analysis

This vulnerability allows attackers to upload malicious SVG files that execute JavaScript in victims' browsers when accessed. This can lead to phishing attacks, where users are tricked into entering credentials on fake login pages. The stored nature means the payload persists on the server, affecting anyone who views the file. While session cookies are not directly accessible due to separate storage origins, other risks like credential theft and persistent malicious content hosting remain.

Mitigation Strategies

Upgrade to Helium version 2.2.60 or later. Block SVG and HTML file uploads by adding their extensions and MIME types to BLOCKED_ATTACHMENT_EXTENSIONS and BLOCKED_ATTACHMENT_MIME_TYPES in conf/configs/common.py. Remove any existing malicious SVG or HTML attachments from the server.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55876. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart