XXE in Ministry of Justice's UYAP Document Editor
Priority LOW 27CWE-611Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-611 and the CVSS impact.
Summary
Improper restriction of XML external entity reference vulnerability in Ministry of Justice UYAP Document Editor allows Serialized Data External Linking. This issue affects UYAP Document Editor: from 4.5.17 before 5.4.17.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00171 6th percentileScored 2026-11-07
Fix Fixed UYAP Document Editor (Ministry of Justice): 5.4.17
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| The Ministry of Justice | UYAP Document Editor | 4.5.17 to before 5.4.17 | 5.4.17 | Patch available | CNA |
- UYAP Document Editor VendorThe Ministry of Justice Affected 4.5.17 to before 5.4.17 Fixed in 5.4.17 Patch available CNA
Remediation
- Fix · CNA UYAP Document Editor (Ministry of Justice) Fixed in 5.4.17
Timeline
- 2026-10-02 Threatist record created from CVE-2026-16999
- 2026-10-03 Alias added: GHSA-vw7v-jmvx-4grc
References
Sources
- CVE-2026-16999 · CVE Program
- CVE-2026-16999 · NVD
- FIRST EPSS
- GHSA-vw7v-jmvx-4grc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences