CVE-2026-16999

Full vulnerability record from the local CVENow database.

Description

Improper restriction of XML external entity reference vulnerability in Ministry of Justice UYAP Document Editor allows Serialized Data External Linking. This issue affects UYAP Document Editor: from 4.5.17 before 5.4.17.

Severity

MEDIUM

CVSS score

6.3 (v3.1)

Vulnerability status

Deferred

Source identifier

[email protected]

Published

2026-08-12 14:17:47.890000

Last modified

2026-10-23 20:10:00.160000

View original CVE JSON

{
  "id": "CVE-2026-16999",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-12T14:17:47.890",
  "lastModified": "2026-10-23T20:10:00.160",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper restriction of XML external entity reference vulnerability in Ministry of Justice UYAP Document Editor allows Serialized Data External Linking.\n\nThis issue affects UYAP Document Editor: from 4.5.17 before 5.4.17."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad por restricción inadecuada de referencia a entidad externa XML en el Editor de Documentos UYAP del Ministerio de Justicia permite el enlace externo de datos serializados.\n\nEste problema afecta al Editor de Documentos UYAP: desde la 4.5.17 antes de la 5.4.17."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Ministry of Justice",
          "product": "UYAP Document Editor",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "4.5.17",
              "lessThan": "5.4.17",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 4.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-12T18:47:07.671400Z",
          "id": "CVE-2026-16999",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-611"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0818",
      "source": "[email protected]"
    }
  ]
}