CVE-2026-18390
HighCVSS 7.8Summary
An OS command injection vulnerability in UYAP Document Editor allows arbitrary command execution. Affects versions before 5.4.20.
Risk Assessment
An attacker can execute arbitrary commands on the server or workstation, leading to full system compromise.
Recommendation
Update UYAP Document Editor to version 5.4.20 or later. Restrict access to the application and apply the principle of least privilege.
Other vulnerabilities in UYAP Document Editor
See all- CVE-2026-12613High
A deserialization of untrusted data vulnerability in UYAP Document Editor allows object injection. Affects versions before 5.4.20.
- CVE-2026-16999Medium
UYAP Document Editor (Ministry of Justice) has an improper restriction of XML external entity reference vulnerability (XXE), allowing Serialized Data External Linking. This affects versions from 4.5.17 before 5.4.17.
Original NVD description (English source)
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor allows OS Command Injection. This issue affects UYAP Document Editor: before 5.4.20.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS