PT-2026-34848 · Frappe · Press

T3L3Sc0P3 · Published 2026-04-24 · Updated 2026-04-30 · CVE-2026-41430

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Press (affected versions not specified)

Description Press is a Frappe custom app used for managing infrastructure, subscriptions, marketplace, and software-as-a-service (SaaS) on Frappe Cloud. The redirect parameter on the login page is susceptible to reflected Cross-Site Scripting (XSS), a flaw where an application includes untrusted data in a web page without proper validation, allowing an attacker to execute scripts in the victim's browser.

Recommendations Restrict redirects to internal URLs only to prevent the execution of malicious scripts via the redirect parameter.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-41430

Affected Products

Press

References · 5

• https://github.com/frappe/press/commit/16d1b6ca2559f858a1de77bcb03fd7f1b81671c6 · Patch
• https://github.com/frappe/press/security/advisories/GHSA-mpww-rq79-8r2c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41430 · Security Note
• https://t.me/cveNotify/161557 · Telegram Post
• https://twitter.com/CVEnew/status/2048099326438609037 · Twitter Post