{"id":"CVE-2026-55875","revision":"b98598f5de214a1c8caaf801cfaf09c1","records":[{"revision":"b98598f5de214a1c8caaf801cfaf09c1","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-55875","aliases":[],"title":"Helium: SSRF via External Calendar URL Allows Authenticated Users to Probe Internal Network","description":"Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, any authenticated user can submit an arbitrary URL to POST /feed/externalcalendars/, where helium/feed/services/icalexternalcalendarservice.py uses validate_url to check only URL syntax before passing the value to urllib.request.urlopen, and fetch_ical_conditional periodically refetches the stored URL. The server can therefore issue requests to attacker-selected external or internal hosts, while distinct responses, including an uncaught http.client.RemoteDisconnected condition for non-HTTP services, reveal internal host and port reachability. The supported impact is forced outbound requests and internal service reconnaissance; the advisory does not demonstrate secret retrieval because the relevant ECS credentials path is task-specific and unpredictable. This issue is fixed in version 2.2.60.","state":0,"publishedAt":"2026-10-15T17:24:00.931+00:00","modifiedAt":"2026-10-15T17:48:20.682+00:00","affected":[{"ecosystem":"Vendor product","name":"platform","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"HeliumEdu\",\n                    \"product\": \"platform\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 2.2.60\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":4.3,"severity":"MEDIUM"}],"references":["https://github.com/HeliumEdu/platform/security/advisories/GHSA-2f83-94pv-v3f5","https://github.com/HeliumEdu/platform/commit/f0de5c985c701942758b805a3d11dfb008a6af88"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-55875","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-55875","identifiers":["CVE-2026-55875"]},"retained":false,"historicalAffected":[]}],"coverage":[]}