# CVE-2026-59669: Repasat cross-site scripting in attachment types

Source: https://junglewise.ai/threats/cve-2026-59669-cross-site-scripting-vulnerability-in-the-repasat-application  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-02. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-59669 · Severity: info · Published 2026-10-02

Repasat is business management software that consolidates enterprise operations on a single platform. The application contains a cross-site scripting flaw in its attachment types feature that could allow an attacker to trick a user into executing malicious code in their browser, potentially leading to unauthorized access or data theft.

Technologies: [Repasat](https://junglewise.ai/threats/technologies/repasat). Vendors: [Repasat](https://junglewise.ai/threats/vendors/repasat).

## Quick answers

**Is CVE-2026-59669 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59669 being exploited in the wild.

**How severe is CVE-2026-59669?** Informational severity, published 2 October 2026.

**Which products and versions are affected?** Repasat prior to 20260402 patch.

**Is there a fix for CVE-2026-59669?** Yes: fixed in 20260402. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59669 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-59669?** Check whether you run Repasat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 20260402

## Technical details

Cross-site scripting vulnerability in the "name" parameter of the /es/attachmenttypes/update/203336 endpoint in Repasat. The vulnerability requires user interaction (a logged-in user must be tricked into visiting a malicious link) and network-based attack vector. Exploitation allows arbitrary JavaScript execution in the victim's browser context with their privileges.

## Affected products

- REPASAT Repasat prior to 20260402 patch

## Timeline

- 2026-10-02: disclosed

## References

- [https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-repasat-application](https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-repasat-application)

## Related threats

- [Repasat application cross-site scripting in company size parameter](https://junglewise.ai/threats/cve-2026-59668-cross-site-scripting-vulnerability-in-the-repasat-application)
- [Repasat cross-site scripting in company size employees endpoint](https://junglewise.ai/threats/cve-2026-59667-cross-site-scripting-vulnerability-in-the-repasat-application)
- [Repasat business management software XSS vulnerabilities](https://junglewise.ai/threats/cve-2026-59666-cross-site-scripting-vulnerability-in-the-repasat-application)
- [Repasat cross-site scripting in parameters](https://junglewise.ai/threats/cve-2026-95662-cross-site-scripting-vulnerability-in-the-repasat-application)
- [Repasat multiple cross-site scripting vulnerabilities](https://junglewise.ai/threats/cve-2026-59673-cross-site-scripting-vulnerability-in-the-repasat-application)