CVE-2026-16999 in UYAP Document Editor
Summary
by MITRE • 08/12/2026
Improper restriction of XML external entity reference vulnerability in Ministry of Justice UYAP Document Editor allows Serialized Data External Linking.
This issue affects UYAP Document Editor: from 4.5.17 before 5.4.17.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/12/2026
The vulnerability under discussion represents a critical improper restriction of XML external entity reference flaw within the Ministry of Justice UYAP Document Editor software, specifically impacting versions ranging from 4.5.17 through to before 5.4.17. This weakness enables malicious actors to exploit serialized data external linking mechanisms, creating potential pathways for unauthorized data access and system compromise. The vulnerability stems from insufficient validation of XML entities during document processing, allowing attackers to reference external resources that could contain harmful content or trigger unwanted system behaviors.
This technical flaw aligns with CWE-611, which specifically addresses improper restriction of XML external entity reference vulnerabilities, and represents a significant security gap in the document editor's XML parsing implementation. The vulnerability operates by permitting XML parsers to resolve external entity references without proper sanitization, enabling attackers to craft malicious documents that can trigger unauthorized network connections or file system access during document processing. The serialized data external linking capability provides an additional attack vector where serialized objects can reference external resources, amplifying the potential impact of the underlying XML parsing vulnerability.
The operational impact of this vulnerability extends beyond simple data exposure, potentially enabling attackers to perform server-side request forgery attacks, execute arbitrary code through deserialization of malicious payloads, or access sensitive internal network resources. When users open maliciously crafted documents, the editor's XML parser processes external entity references that can trigger connections to attacker-controlled servers, potentially leaking internal system information or facilitating further exploitation. The vulnerability affects document processing workflows within the justice ministry's systems, where document editors are frequently used to handle sensitive legal documents, making this a particularly concerning weakness in a security-critical environment.
Organizations utilizing affected UYAP Document Editor versions should immediately implement mitigations including updating to patched versions 5.4.17 or later, implementing strict XML parser configurations that disable external entity resolution, and deploying network segmentation controls to limit potential attack surface. The ATT&CK framework categorizes this vulnerability under T1213 - Data from Information Repositories, as it enables unauthorized access to document repositories, while also mapping to T1059 - Command and Scripting Interpreter through potential code execution capabilities. Additional protective measures should include implementing strict file validation policies, monitoring for unusual network connections during document processing, and establishing privileged access controls for document editor applications to limit the potential impact of successful exploitation attempts.
The vulnerability demonstrates a classic example of how seemingly minor parsing configurations can create significant security risks in enterprise document processing systems. Organizations should conduct comprehensive security assessments of their document handling workflows, particularly those involving XML-based formats, and implement robust input validation mechanisms across all components that process external data sources. Regular security updates and patch management procedures become critical in preventing exploitation of such vulnerabilities, especially within government and legal environments where data sensitivity and system integrity requirements are paramount for maintaining public trust and regulatory compliance standards.