UYAP Document Editor CVE-2026-16999

Exploitation requires that the victim user actively opens a specially crafted XML-based document within the vulnerable UYAP Document Editor (versions 4.5.17 to before 5.4.17). The attack is local in vector (AV:L), meaning the malicious document must already be present on or delivered to the local file system - remote unauthenticated exploitation over a network is not applicable. No elevated privileges are required to open the document, but user interaction (opening the file) is mandatory. Exploitation is limited to users running affected versions of UYAP Document Editor, which is a government-specific judicial application predominantly deployed within Turkey's Ministry of Justice ecosystem. Key limiting factors: (1) the attacker must successfully deliver the crafted document to the target user, (2) the user must actively open it, and (3) the file system paths readable via XXE are constrained by the OS-level permissions of the running user account.

The CVSS 3.1 base score of 6.3 (Medium) is consistent with the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N. The local attack vector (AV:L) limits exposure significantly - an attacker cannot exploit this remotely without first delivering a malicious document to the target machine. User interaction (UI:R) adds a further friction point: exploitation depends on a victim actively opening the crafted file. However, confidentiality impact is rated High with scope change, meaning a successful attack can read sensitive system files (e.g., credentials, configuration, private documents). No EPSS score data was provided, making probabilistic exploitation assessment unavailable. The vulnerability is not listed in CISA KEV and no public proof-of-concept exploit has been identified. Given the niche government-specific deployment context of UYAP Document Editor, realistic risk is bounded to organizations within Turkey's judicial and legal system. The primary real-world threat is a targeted spear-phishing or insider document delivery scenario, not opportunistic mass exploitation.

An attacker crafts a malicious document embedding an XXE payload that references a sensitive local file (e.g., a credentials store or private configuration file). The document is delivered to a UYAP Document Editor user via email or shared storage within a judicial or legal organization. When the user opens the file, the unpatched editor resolves the external entity, and the contents of the targeted file are disclosed to the attacker.