CVE-2026-16999

MediumCVSS 6.3

Published: 12/08/2026(UTC)Updated: 12/08/2026(UTC)Translated: 12/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.13%

3th percentile - higher than 3% of all known CVEs

Summary

UYAP Document Editor (Ministry of Justice) has an improper restriction of XML external entity reference vulnerability (XXE), allowing Serialized Data External Linking. This affects versions from 4.5.17 before 5.4.17.

Risk Assessment

An attacker could exploit XXE to read files from the server or perform SSRF attacks, potentially leading to data leakage.

Recommendation

Upgrade UYAP Document Editor to version 5.4.17 or later, which includes a fix.

Original NVD description (English source)

Improper restriction of XML external entity reference vulnerability in Ministry of Justice UYAP Document Editor allows Serialized Data External Linking. This issue affects UYAP Document Editor: from 4.5.17 before 5.4.17.