CVE-2026-16999
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
UYAP Document Editor (Ministry of Justice) has an improper restriction of XML external entity reference vulnerability (XXE), allowing Serialized Data External Linking. This affects versions from 4.5.17 before 5.4.17.
Risk Assessment
An attacker could exploit XXE to read files from the server or perform SSRF attacks, potentially leading to data leakage.
Recommendation
Upgrade UYAP Document Editor to version 5.4.17 or later, which includes a fix.
Other vulnerabilities in UYAP Document Editor
See all- CVE-2026-18390High
OS command injection vulnerability in UYAP Document Editor before version 5.4.20 on Windows and Linux and before 5.4.21 on iOS. Improper neutralization of special elements allows execution of arbitrary system commands.
- CVE-2026-12613High
Deserialization of untrusted data vulnerability in UYAP Document Editor on Windows, Linux, and MacOS before versions 5.4.20/5.4.21 allows Object Injection.
Original NVD description (English source)
Improper restriction of XML external entity reference vulnerability in Ministry of Justice UYAP Document Editor allows Serialized Data External Linking. This issue affects UYAP Document Editor: from 4.5.17 before 5.4.17.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS