CVE-2026-55875

Name of the Vulnerable Software and Affected Versions Helium versions prior to 2.2.60

Description Authenticated users can submit an arbitrary URL to the 'POST /feed/externalcalendars/' endpoint. The system uses the validate url function to check only the syntax before passing the value to urllib.request.urlopen, and the fetch ical conditional function periodically refetches the stored URL. This allows the server to issue requests to external or internal hosts selected by an attacker. Different responses, such as an uncaught http.client.RemoteDisconnected condition for non-HTTP services, can reveal the reachability of internal hosts and ports, enabling forced outbound requests and internal service reconnaissance.

Recommendations Update to version 2.2.60.