EUVD-2026-97430
GHSA-m3wc-m3g8-wx7q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious serialized document
-
DeliveryDeliver file to target user
-
ExploitVictim opens document in editor
-
ExecutionUntrusted data deserialized (object injection)
-
ImpactCode execution in user context
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a user to open or process an attacker-supplied malicious document within the UYAP Document Editor at a version before 5.4.20 - the UI:R metric confirms this user interaction is mandatory, which is the primary limiting factor. No authentication is needed (PR:N), and no special non-default configuration is indicated; the vulnerability lies in the editor's handling/deserialization of document data itself. Realistic exploitation is further constrained by the product's deployment being confined to the Turkish judicial (UYAP) user base, requiring the attacker to target that specific population and induce file opening (e.g., via a case submission or email attachment). |
| Impact | This is a CWE-502 deserialization/object-injection flaw with a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating network-reachable, low-complexity, unauthenticated exploitation that nonetheless REQUIRES user interaction (UI:R) - consistent with a victim opening a maliciously crafted document in the editor rather than a fully remote drive-by. The triad of high confidentiality, integrity, and availability impact reflects the typical outcome of unsafe deserialization: attacker-controlled object injection leading to code execution in the user's context. Real-world urgency, however, is tempered by missing corroborating signals: no EPSS probability is provided, there is no CISA KEV listing (KEV=NO), and no public proof-of-concept is referenced (POC=NO), so there is no evidence of active or at-scale exploitation. No SSVC decision data was supplied. The strongest mitigating factor is the UI:R requirement combined with the product's narrow deployment (Turkey's national judicial UYAP ecosystem), which makes targeted social-engineering attacks against Turkish legal/government users far more plausible than widespread opportunistic exploitation. Net: a genuinely high-severity vulnerability worth prompt patching for affected UYAP users, but not a broad internet-wide emergency given the lack of exploitation evidence and niche footprint. |
| Exploit ScenarioDerived | An attacker crafts a malicious UYAP document embedding a serialized object payload and delivers it to a target (e.g., via email or a case-file submission) within the Turkish judicial workflow. When the victim opens the file in a vulnerable UYAP Document Editor (before 5.4.20), the untrusted data is deserialized, triggering object injection and arbitrary code execution in the victim's context. No public exploit code is identified at time of analysis, so this scenario is inferred from the CWE-502 class and the UI:R attack vector. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Unsafe deserialization in the UYAP Document Editor before version 5.4.20 allows an attacker to inject objects into the application through a crafted document, resulting in code execution with the privileges of the editor process (CVSS 3.1 base 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-502). Exploitation is unauthenticated and network-reachable with low complexity, but requires the victim to open or process an attacker-supplied malicious document (UI:R), which is the principal limiting factor; no public exploit has been identified at time of analysis, and the product is deployed specifically within the Turkish judicial (UYAP) user base, narrowing the realistic target set. Successful exploitation yields high confidentiality, integrity, and availability impact within the affected user's scope.
RemediationAI
The primary fix is to upgrade UYAP Document Editor to version 5.4.20 or later, the first version above the affected range stated in the advisory, and to verify the installed build through the UYAP update mechanism; consult the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1299 for the vendor's distribution instructions. Because the vulnerability is triggered by opening a malicious document, until the upgrade is applied the most effective compensating control is to avoid opening UYAP editor files from untrusted or unexpected sources - unsolicited email attachments, files received outside the official UYAP case-submission flow, or documents from unknown parties - and to verify document provenance before opening; the trade-off is that this depends on user discipline and can disrupt legitimate case workflows. Organizations can additionally restrict or remove the UYAP document file-type association from desktop email clients and browsers so that such files cannot be launched by a single click, at the cost of convenience for routine case handling, and can restrict the editor's outbound network access or run it under a low-privilege, isolated account/profile to blunt post-exploitation code execution, though the security scope of the CVE (S:U) means the editor's own process privileges are what an attacker gains. Endpoint detection should be tuned to flag anomalous child processes spawned by the editor (script interpreters, command shells, or office/living-off-the-land binaries) as a detection backstop rather than a preventive fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-502 deserialization of untrusted data issue (object injection) in the Turkish Ministry of Justice General Directorate of Information Technology's UYAP Document Editor, the client application used to prepare, view, and submit documents in the national UYAP judicial case-management ecosystem. Rather than a memory-safety bug, the weakness is that the editor reconstructs objects from serialized content embedded in document files without validating the type or origin of that content, so a maliciously crafted document supplied to the user can trigger instantiation or invocation of attacker-chosen classes during deserialization - the classic object-injection path to arbitrary code execution in the context of the editor process. The CPE string cpe:2.3:a:ministry_of_justice_general_directorate_of_information_technology:uyap_document_editor:*:*:*:*:*:*:*:* with no version bounds confirms the identifier covers the product as a whole, and the advisory scopes the vulnerable range to all releases prior to 5.4.20. The vector AV:N/AC:L/PR:N/UI:R/S:U indicates the payload is delivered over a network channel (e.g., email, download, or case-submission workflow) with no prior authentication and no privileges required, but that the user must take the action of opening or processing the document - meaning exploitation is user-driven rather than a remote drive-by, even though the impact is confined to the single-user security scope (S:U).
Know when Uyap Document Editor gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Malicious document is network-delivered and unauthenticated (AV:N/PR:N) but must be opened by a victim (UI:R); deserialization yields code execution with full C/I/A impact.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
Lifecycle Timeline
2DescriptionCVE.org
Deserialization of untrusted data vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor allows Object Injection.
This issue affects UYAP Document Editor: before 5.4.20.
Executive ViewAI
UYAP Document Editor, the case-file editing tool used across the Turkish judicial system, carries an unpatched unsafe deserialization flaw that allows a crafted document to execute attacker code with the editor's own privileges on the reviewer's workstation. Exploitation requires no credentials and no special network position - only that a user open a malicious document - so the realistic attack path runs through email, shared case files, and court-submitted attachments, placing judges, prosecutors, and court staff rather than central infrastructure at risk. With no vendor-released patch identified at time of analysis, leadership should treat document-handling workflows as the exposed surface and fund interim containment instead of assuming a narrowly scoped user base makes the risk self-limiting.
No vendor-released patch identified at time of analysis; interim mitigations include restricting document intake to trusted case channels, gateway filtering of embedded objects and archives, running the editor without administrative privileges, OS attack-surface-reduction and application-control policies that block the editor from spawning child processes, endpoint monitoring for unexpected process or network activity from the editor, isolation of document review on constrained or non-persistent workstations, and rapid quarantine and sandbox analysis of suspicious documents.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
More in Uyap Document Editor
View allOS command injection in the Ministry of Justice General Directorate of Information Technology's UYAP Document Editor bef
XML External Entity (XXE) injection in UYAP Document Editor versions 4.5.17 through 5.4.17 allows a local attacker to ex
Exploit-DB