Medium severity6.1NVD Advisory· Published Apr 24, 2026· Updated Apr 30, 2026

CVE-2026-41430

Description

Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS). Redirect parameter on login page is vulnerable to reflected XSS. The patch in commit 16d1b6ca2559f858a1de77bcb03fd7f1b81671c6 fixes the issue by restricting redirects to internal URLs only.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Frappe/Press2 versions
cpe:2.3:a:frappe:press:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:frappe:press:*:*:*:*:*:*:*:*range: <0.16.0
- (no CPE)

Patches

Vulnerability mechanics

References

github.com/frappe/press/commit/16d1b6ca2559f858a1de77bcb03fd7f1b81671c6nvdPatch
github.com/frappe/press/security/advisories/GHSA-mpww-rq79-8r2cnvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.397
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000