UYAP Document Editor EUVD-2026-97437

Exploitation requires a local attack path (AV:L) and user interaction (UI:R): a victim must open an attacker-crafted document in UYAP Document Editor before version 5.4.20, which then fails to neutralize special elements and executes injected OS commands. No authentication is required (PR:N), but the dependency on social-engineering the user into opening a malicious file is the primary limiting factor; there is no remote, unauthenticated, or default-exposed network surface. The description specifies no additional configuration prerequisite - the flaw affects the editor's document-handling path itself.

The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local, low-complexity OS command injection requiring no privileges but mandating user interaction - consistent with a victim opening a crafted document in UYAP Document Editor rather than remote network exploitation. No EPSS probability, CISA KEV listing, or public POC is present in the supplied intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the only sourcing is a single TR-CERT (Turkish national CERT) advisory. The high base score is driven by full C/I/A impact of arbitrary command execution, but real-world risk is tempered by the local attack vector, the required user interaction, and the product's narrow deployment (Turkey's judicial ecosystem). Net: a genuine high-impact flaw worth patching for affected Turkish Ministry of Justice users, but not a mass-exploitation priority on current signals - treat as targeted/insider-relevant rather than internet-wide. No conflicting signals were detected; the main gap is the absence of EPSS/KEV/POC data, which limits certainty about exploitation likelihood.

An attacker crafts a malicious document containing embedded OS command sequences and delivers it to a court or legal-system user (e.g., via email or a filed case document). When the victim opens the file in a vulnerable UYAP Document Editor (before 5.4.20), special elements are improperly neutralized and injected OS commands execute in the user's context. No public exploit code is identified at time of analysis.