EUVD-2026-57212
GHSA-vw7v-jmvx-4grc
Severity by source
AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
File-based delivery requires local access (AV:L) and user action (UI:R); XXE reads OS files crossing scope (S:C/C:H) with no write or availability impact.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
Improper restriction of XML external entity reference vulnerability in Ministry of Justice UYAP Document Editor allows Serialized Data External Linking.
This issue affects UYAP Document Editor: from 4.5.17 before 5.4.17.
AnalysisAI
XML External Entity (XXE) injection in UYAP Document Editor versions 4.5.17 through 5.4.17 allows a local attacker to exfiltrate sensitive file system contents by tricking a user into opening a specially crafted document. The vulnerability enables serialized data external linking via uncontrolled XML external entity resolution, resulting in high confidentiality impact with scope change to the underlying operating system. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the victim user actively opens a specially crafted XML-based document within the vulnerable UYAP Document Editor (versions 4.5.17 to before 5.4.17). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 6.3 (Medium) is consistent with the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a malicious document embedding an XXE payload that references a sensitive local file (e.g., a credentials store or private configuration file). The document is delivered to a UYAP Document Editor user via email or shared storage within a judicial or legal organization. … |
| Remediation | Upgrade UYAP Document Editor to version 5.4.17 or later, which resolves the improper XML external entity handling per the TR-CERT advisory at https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0818. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today