What’s Vulnerable › Vulnerabilities
CVE-2026-16999: XXE in Ministry of Justice's UYAP Document Editor
- Severity: medium (CVSS 6.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-12 · updated 2026-10-23
- Weakness: CWE-611
Description
Improper restriction of XML external entity reference vulnerability in Ministry of Justice UYAP Document Editor allows Serialized Data External Linking. This issue affects UYAP Document Editor: from 4.5.17 before 5.4.17.
Affected products
- Ministry of Justice UYAP Document Editor: from 4.5.17 before 5.4.17 — fixed in 5.4.17
How to fix
Upgrade to a fixed version: Ministry of Justice UYAP Document Editor 5.4.17. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-16999 or the next vulnerability affects your stack