CVE-2026-55875: Helium: SSRF via External Calendar URL Allows Authenticated Users to Probe Internal Network
Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, any authenticated user can submit an arbitrary URL to POST /feed/externalcalendars/, where helium/feed/services/icalexternalcalendarservice.py uses validateurl to check only URL syntax before passing the value to urllib.request.urlopen, and fetchicalconditional periodically refetches the stored URL. The server can therefore issue requests to attacker-selected external or internal hosts, while distinct responses, including an uncaught http.client.RemoteDisconnected condition for non-HTTP services, reveal internal host and port reachability. The supported impact is forced outbound requests and internal service reconnaissance; the advisory does not demonstrate secret retrieval because the relevant ECS credentials path is task-specific and unpredictable. This issue is fixed in version 2.2.60.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Heliumto a version that resolves this vulnerability.Fixed in 2.2.60
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Helium user can submit an arbitrary calendar URL to the external-calendar endpoint. No user interaction beyond the attacker’s own authenticated request is required.
What systems can be reached through the vulnerable server?
The server can be induced to make requests to attacker-selected external or internal hosts. Response differences, including an uncaught RemoteDisconnected error from non-HTTP services, can disclose whether internal hosts and ports are reachable.
Are stored URLs fetched only when they are submitted?
No. The application periodically refetches the stored external calendar URL, so a malicious URL can cause repeated outbound requests after initial submission.
What is the impact if the issue is exploited?
The demonstrated impact is server-side forced outbound requests and internal service reconnaissance. The advisory does not demonstrate retrieval of secrets or other internal data.
Which version fixes the issue?
Upgrade Helium to version 2.2.60. Versions prior to 2.2.60 are affected.