CVE-2026-18390
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
OS command injection vulnerability in UYAP Document Editor before version 5.4.20 on Windows and Linux and before 5.4.21 on iOS. Improper neutralization of special elements allows execution of arbitrary system commands.
Risk Assessment
An attacker can execute arbitrary commands on the server or device, potentially leading to full system compromise and data breach.
Recommendation
Update UYAP Document Editor to version 5.4.20 (Windows/Linux) or 5.4.21 (iOS) or later, which contains the fix.
Other vulnerabilities in UYAP Document Editor
See all- CVE-2026-12613High
Deserialization of untrusted data vulnerability in UYAP Document Editor on Windows, Linux, and MacOS before versions 5.4.20/5.4.21 allows Object Injection.
- CVE-2026-16999Medium
UYAP Document Editor (Ministry of Justice) has an improper restriction of XML external entity reference vulnerability (XXE), allowing Serialized Data External Linking. This affects versions from 4.5.17 before 5.4.17.
Original NVD description (English source)
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor on Windows and Linux and Ministry of Justice General Directorate of Information Technology UYAP Document Editor on iOS allows OS Command Injection. This issue affects UYAP Document Editor: before 5.4.20; UYAP Document Editor: before 5.4.21.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS