PT-2026-34848 · Frappe · Press

T3L3Sc0P3 · CVE-2026-41430 · Published 2026-04-24 · Updated 2026-04-30

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Press (affected versions not specified)

Description Press is a Frappe custom app used for managing infrastructure, subscriptions, marketplace, and software-as-a-service (SaaS) on Frappe Cloud. The redirect parameter on the login page is susceptible to reflected Cross-Site Scripting (XSS), a flaw where an application includes untrusted data in a web page without proper validation, allowing an attacker to execute scripts in the victim's browser.

Recommendations Restrict redirects to internal URLs only to prevent the execution of malicious scripts via the redirect parameter.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-41430

GHSA-MPWW-RQ79-8R2C

Affected Products

Press

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41430.json · Exploit
• https://github.com/frappe/press/commit/16d1b6ca2559f858a1de77bcb03fd7f1b81671c6 · Patch
• https://github.com/frappe/press/security/advisories/GHSA-mpww-rq79-8r2c · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-41430 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41430 · Security Note
• https://twitter.com/CVEnew/status/2048099326438609037 · Twitter Post
• https://t.me/cveNotify/161557 · Telegram Post