CVE-2026-41430

Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS). Redirect parameter on login page is vulnerable to reflected XSS. The patch in commit 16d1b6ca2559f858a1de77bcb03fd7f1b81671c6 fixes the issue by restricting redirects to internal URLs only.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/frappe/press/commit/16d1b6ca2559f858a1de77bcb03fd7f1b81671c6	Patch
https://github.com/frappe/press/security/advisories/GHSA-mpww-rq79-8r2c	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:frappe:press:*:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Press, una aplicación personalizada de Frappe que ejecuta Frappe Cloud, gestiona la infraestructura, las suscripciones, el mercado y el software como servicio (SaaS). El parámetro de redirección en la página de inicio de sesión es vulnerable a XSS reflejado. El parche en el commit 16d1b6ca2559f858a1de77bcb03fd7f1b81671c6 soluciona el problema al restringir las redirecciones solo a URL internas.

Information

Published : 2026-04-24 04:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-41430

Mitre link : CVE-2026-41430

CVE.ORG link : CVE-2026-41430

JSON object : View

Products Affected

frappe

press

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-41430", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41430", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-24T17:22:42.830229Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 1.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "UNREPORTED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "frappe", "product": "press", "versions": [{"status": "affected", "version": "< 16d1b6ca2559f858a1de77bcb03fd7f1b81671c6"}]}]}], "published": "2026-04-24T04:16:21.000", "references": [{"url": "https://github.com/frappe/press/commit/16d1b6ca2559f858a1de77bcb03fd7f1b81671c6", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/frappe/press/security/advisories/GHSA-mpww-rq79-8r2c", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS). Redirect parameter on login page is vulnerable to reflected XSS. The patch in commit 16d1b6ca2559f858a1de77bcb03fd7f1b81671c6 fixes the issue by restricting redirects to internal URLs only."}, {"lang": "es", "value": "Press, una aplicaci\u00f3n personalizada de Frappe que ejecuta Frappe Cloud, gestiona la infraestructura, las suscripciones, el mercado y el software como servicio (SaaS). El par\u00e1metro de redirecci\u00f3n en la p\u00e1gina de inicio de sesi\u00f3n es vulnerable a XSS reflejado. El parche en el commit 16d1b6ca2559f858a1de77bcb03fd7f1b81671c6 soluciona el problema al restringir las redirecciones solo a URL internas."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:frappe:press:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B9782269-49C1-45E2-91B2-E6F2AE3DCB8A", "versionEndExcluding": "0.16.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}