CVE-2026-55875: CWE-918: Server-Side Request Forgery (SSRF) in HeliumEdu platform
Description
Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, any authenticated user can submit an arbitrary URL to POST /feed/externalcalendars/, where helium/feed/services/icalexternalcalendarservice.py uses validate_url to check only URL syntax before passing the value to urllib.request.urlopen, and fetch_ical_conditional periodically refetches the stored URL. The server can therefore issue requests to attacker-selected external or internal hosts, while distinct responses, including an uncaught http.client.RemoteDisconnected condition for non-HTTP services, reveal internal host and port reachability. The supported impact is forced outbound requests and internal service reconnaissance; the advisory does not demonstrate secret retrieval because the relevant ECS credentials path is task-specific and unpredictable. This issue is fixed in version 2.2.60.
CVSS v3.1
Score 4.3medium
Affected software
HeliumEdu
platform
pkg:github/heliumedu/platformRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-55875 is an SSRF vulnerability in HeliumEdu platform versions before 2.2.60. The vulnerability arises because the URL submitted by authenticated users to the POST /feed/externalcalendars/ endpoint is only syntactically validated before being passed to urllib.request.urlopen. The server then fetches the URL periodically, enabling attackers to induce server-side requests to arbitrary hosts, including internal services. Different server responses, including uncaught RemoteDisconnected exceptions, can be used to infer internal host and port reachability. The vulnerability does not demonstrate secret or credential disclosure due to the unpredictable nature of ECS credentials paths. The vendor fixed this issue in version 2.2.60.
Potential Impact
An attacker with authentication can force the server to make arbitrary outbound requests, potentially allowing internal network reconnaissance. This can reveal the presence and reachability of internal services and ports. There is no confirmed impact on confidentiality beyond limited internal host and port discovery, and no demonstrated ability to retrieve secrets or credentials. The CVSS score is 4.3 (medium severity) reflecting limited confidentiality impact and no integrity or availability impact.
Mitigation Recommendations
Upgrade the HeliumEdu platform to version 2.2.60 or later, where this SSRF vulnerability is fixed. No additional mitigation is required if the platform is updated. If upgrading is not immediately possible, restrict authenticated user access or monitor for suspicious use of the /feed/externalcalendars/ endpoint, but note that the official fix is the recommended remediation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-17T16:59:42.759Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad10e922cdf04f6564bcc10
Added to database: 10/15/2026, 17:34:10 UTC
Last enriched: 10/15/2026, 17:48:43 UTC
Last updated: 10/15/2026, 19:00:26 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.