Press vulnerable to reflected XSS on login redirection
Priority LOW 7CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- None · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS). Redirect parameter on login page is vulnerable to reflected XSS. The patch in commit 16d1b6ca2559f858a1de77bcb03fd7f1b81671c6 fixes the issue by restricting redirects to internal URLs only.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00155 4th percentileScored 2026-11-07
Fix Fixed press (frappe): 16d1b6ca2559f858a1de77bcb03fd7f1b81671c6
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| frappe | press | before 16d1b6ca2559f858a1de77bcb03fd7f1b81671c6 | 16d1b6ca2559f858a1de77bcb03fd7f1b81671c6 | Patch available | CNA |
- press Vendorfrappe Affected before 16d1b6ca2559f858a1de77bcb03fd7f1b81671c6 Fixed in 16d1b6ca2559f858a1de77bcb03fd7f1b81671c6 Patch available CNA
Remediation
- Fix · CNA press (frappe) Fixed in 16d1b6ca2559f858a1de77bcb03fd7f1b81671c6
Timeline
- 2026-10-02 Threatist record created from CVE-2026-41430
References
More frappe Press vulnerabilities
- TI-2026-29918 Frappe Press has an unsafe HTTP method / CSRF-adjacent issue on API secret generation CVSS 4.0MEDIUM 6.6
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences