CVE-2026-55876: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in HeliumEdu platform

The HeliumEdu platform's attachment upload endpoint did not block SVG and HTML file formats prior to version 2.2.60, allowing authenticated users to upload SVG files with embedded scripts. When these SVG attachments are served with the image/svg+xml MIME type and accessed via their public URLs, the embedded scripts execute in the visitor's browser, resulting in persistent cross-site scripting. However, because the attachment storage uses a separate origin from the main application, the same-origin policy prevents the malicious script from accessing application cookies or storage, limiting the impact. The vulnerability is addressed by blocking these file types in version 2.2.60.

The vulnerability allows persistent cross-site scripting via uploaded SVG attachments, which can execute attacker-controlled scripts in the context of the attachment's origin. This can facilitate phishing attacks or display malicious content to users accessing the attachment URL. However, the separation of attachment storage origin from the application origin prevents theft of application cookies or session compromise. The CVSS score is 3.5 (low severity), reflecting limited impact on confidentiality and no impact on availability.

Upgrade the HeliumEdu platform to version 2.2.60 or later, where the issue is fixed by blocking SVG and HTML file formats from being uploaded as attachments. No additional mitigation is required as the fix is official and addresses the root cause.