The HeliumEdu platform allows authenticated users to upload attachments through the /planner/attachments/ endpoint. Because the configuration omits SVG and HTML from the blocklists of disallowed extensions and MIME types, a malicious SVG can be stored and served with the image/svg+xml MIME type. When a visitor opens the public attachment URL, the embedded script executes in the victim’s browser, enabling persistent attacker‑controlled active content or phishing pages. The attachment storage resides on a separate origin, so the script is prevented from accessing application cookies or local storage, limiting the impact to client‑side content only.

HeliumEdu platform versions earlier than 2.2.60 are affected; later releases contain the fix.

With a CVSS score of 3.5 and an EPSS score of less than 1%, the likelihood of exploitation is considered low, and the vulnerability is not yet listed in the CISA KEV catalog. Exploitation requires an authenticated user to upload a malicious SVG and a victim to view the resulting attachment URL. Because the script runs under a different origin, it cannot read or modify the application session or data, so the critical impact is limited to phishing or client‑side attacks.