CVE-2026-12613
HighCVSS 8.8Summary
A deserialization of untrusted data vulnerability in UYAP Document Editor allows object injection. Affects versions before 5.4.20.
Risk Assessment
An attacker can execute malicious code or perform object injection attacks, potentially leading to application compromise.
Recommendation
Update UYAP Document Editor to version 5.4.20 or later. Avoid deserializing untrusted data and use secure alternatives.
Other vulnerabilities in UYAP Document Editor
See all- CVE-2026-18390High
An OS command injection vulnerability in UYAP Document Editor allows arbitrary command execution. Affects versions before 5.4.20.
- CVE-2026-16999Medium
UYAP Document Editor (Ministry of Justice) has an improper restriction of XML external entity reference vulnerability (XXE), allowing Serialized Data External Linking. This affects versions from 4.5.17 before 5.4.17.
Original NVD description (English source)
Deserialization of untrusted data vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor allows Object Injection. This issue affects UYAP Document Editor: before 5.4.20.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS