UYAP Document Editor vulnerabilities

3 known CVE vulnerabilities in UYAP Document Editor, translated and rated.

CVE-2026-18390High
OS command injection vulnerability in UYAP Document Editor before version 5.4.20 on Windows and Linux and before 5.4.21 on iOS. Improper neutralization of special elements allows execution of arbitrary system commands.
CVE-2026-12613High
Deserialization of untrusted data vulnerability in UYAP Document Editor on Windows, Linux, and MacOS before versions 5.4.20/5.4.21 allows Object Injection.
CVE-2026-16999Medium
UYAP Document Editor (Ministry of Justice) has an improper restriction of XML external entity reference vulnerability (XXE), allowing Serialized Data External Linking. This affects versions from 4.5.17 before 5.4.17.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS