CVE-2026-12613: Insecure Deserialization Leading to Remote Code Execution in Ministry of Justice's UYAP Document Editor
Published Oct 12, 2026
·Updated
Deserialization of untrusted data vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor allows Object Injection.
This issue affects UYAP Document Editor: before 5.4.20.
Affected Software
1 affected component
Ministry of Justice UYAP Document Editor<5.4.20
Event History
Oct 12, 2026
CVE Published
via MITRE·02:01 PM
Data Sourced
via MITRE·02:01 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are affected?
UYAP Document Editor versions before 5.4.20 are affected.
2
Can this be exploited remotely without an attacker account?
The CVSS vector indicates network-based exploitation with low attack complexity and no privileges required. It also indicates user interaction is required.
3
What is the potential impact of successful exploitation?
Successful exploitation can result in high impact to confidentiality, integrity, and availability, and the vulnerability is described as allowing object injection through deserialization of untrusted data.