CVE-2026-18390: Command Injection in Ministry of Justice's UYAP Document Editor
Published Oct 12, 2026
·Updated
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor allows OS Command Injection.
This issue affects UYAP Document Editor: before 5.4.20.
Affected Software
1 affected component
Ministry of Justice General Directorate of Information Technology UYAP Document Editor<5.4.20
Event History
Oct 12, 2026
CVE Published
via MITRE·01:57 PM
Data Sourced
via MITRE·01:57 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
The CVSS vector indicates that exploitation requires local access and user interaction. No privileges are required before exploitation.
2
Which installations are affected?
UYAP Document Editor versions before 5.4.20 are affected.