CVE-2026-55876

Name of the Vulnerable Software and Affected Versions Helium versions prior to 2.2.60

Description Authenticated users can upload SVG and HTML attachments via the 'POST /planner/attachments/' endpoint. This occurs because the BLOCKED ATTACHMENT EXTENSIONS and BLOCKED ATTACHMENT MIME TYPES lists in conf/configs/common.py omit these formats, and the attachmentserializer.py file relies on these blocklists. An uploaded SVG served as image/svg+xml can execute embedded scripts when a visitor opens the public attachment URL, enabling persistent attacker-controlled active content and phishing. Due to the same-origin policy, the script cannot read application cookies or storage as the attachment storage uses a separate origin from the application.

Recommendations Update to version 2.2.60.