CVE-2026-16999 - Vulnerability Details - OpenCVE

Improper restriction of XML external entity reference vulnerability in Ministry of Justice UYAP Document Editor allows Serialized Data External Linking.

This issue affects UYAP Document Editor: from 4.5.17 before 5.4.17.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable no

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Ministry of Justice

UYAP Document Editor

unaffected

Version	Status	Constraints
`4.5.17`	affected	< 5.4.17

No data.

No data.

No data.

Project Subscriptions

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0818

History

Wed, 12 Aug 2026 19:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 12 Aug 2026 14:00:00 +0000

Type	Values Removed	Values Added
Description		Improper restriction of XML external entity reference vulnerability in Ministry of Justice UYAP Document Editor allows Serialized Data External Linking. This issue affects UYAP Document Editor: from 4.5.17 before 5.4.17.
Title		XXE in Ministry of Justice's UYAP Document Editor
Weaknesses		CWE-611
References		https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0818
Metrics		cvssV3_1 `{'score': 6.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N'}`

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: TR-CERT

Published: 2026-08-12T13:53:18.644Z

Updated: 2026-08-12T18:47:18.379Z

Reserved: 2026-07-24T09:22:51.337Z

Link: CVE-2026-16999

Vulnrichment

Updated: 2026-08-12T18:47:14.835Z

NVD

Status : Received

Published: 2026-08-12T14:17:47.890

Modified: 2026-08-12T19:17:30.023

Link: CVE-2026-16999

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-611

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-16999", "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "state": "PUBLISHED", "assignerShortName": "TR-CERT", "dateReserved": "2026-07-24T09:22:51.337Z", "datePublished": "2026-08-12T13:53:18.644Z", "dateUpdated": "2026-08-12T18:47:18.379Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2026-08-12T13:53:18.644Z"}, "title": "XXE in Ministry of Justice's UYAP Document Editor", "datePublic": "2026-08-12T13:45:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-611", "description": "CWE-611 Improper restriction of XML external entity reference", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-201", "descriptions": [{"lang": "en", "value": "CAPEC-201 Serialized Data External Linking"}]}], "affected": [{"vendor": "Ministry of Justice", "product": "UYAP Document Editor", "versions": [{"status": "affected", "version": "4.5.17", "lessThan": "5.4.17", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Improper restriction of XML external entity reference vulnerability in Ministry of Justice UYAP Document Editor allows Serialized Data External Linking.\n\nThis issue affects UYAP Document Editor: from 4.5.17 before 5.4.17.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Improper restriction of XML external entity reference vulnerability in Ministry of Justice UYAP Document Editor allows Serialized Data External Linking.<p>This issue affects UYAP Document Editor: from 4.5.17 before 5.4.17.</p>"}]}], "references": [{"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0818", "tags": ["government-resource"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N"}}], "credits": [{"lang": "en", "value": "Mustafa An\u0131l YILDIRIM", "type": "finder"}, {"lang": "en", "value": "Beg\u00fcm ERDAL", "type": "finder"}], "source": {"defect": ["TR-26-0818"], "advisory": "TR-26-0818", "discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.4"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-12T18:47:07.671400Z", "id": "CVE-2026-16999", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-12T18:47:18.379Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-16999", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-12T18:47:07.671400Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-12T18:47:14.835Z"}}], "cna": {"title": "XXE in Ministry of Justice's UYAP Document Editor", "source": {"defect": ["TR-26-0818"], "advisory": "TR-26-0818", "discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Mustafa An\u0131l YILDIRIM"}, {"lang": "en", "type": "finder", "value": "Beg\u00fcm ERDAL"}], "impacts": [{"capecId": "CAPEC-201", "descriptions": [{"lang": "en", "value": "CAPEC-201 Serialized Data External Linking"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Ministry of Justice", "product": "UYAP Document Editor", "versions": [{"status": "affected", "version": "4.5.17", "lessThan": "5.4.17", "versionType": "custom"}], "defaultStatus": "unaffected"}], "datePublic": "2026-08-12T13:45:00.000Z", "references": [{"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0818", "tags": ["government-resource"]}], "x_generator": {"engine": "Vulnogram 1.0.4"}, "descriptions": [{"lang": "en", "value": "Improper restriction of XML external entity reference vulnerability in Ministry of Justice UYAP Document Editor allows Serialized Data External Linking.\n\nThis issue affects UYAP Document Editor: from 4.5.17 before 5.4.17.", "supportingMedia": [{"type": "text/html", "value": "Improper restriction of XML external entity reference vulnerability in Ministry of Justice UYAP Document Editor allows Serialized Data External Linking.<p>This issue affects UYAP Document Editor: from 4.5.17 before 5.4.17.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-611", "description": "CWE-611 Improper restriction of XML external entity reference"}]}], "providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2026-08-12T13:53:18.644Z"}}}, "cveMetadata": {"cveId": "CVE-2026-16999", "state": "PUBLISHED", "dateUpdated": "2026-08-12T18:47:18.379Z", "dateReserved": "2026-07-24T09:22:51.337Z", "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "datePublished": "2026-08-12T13:53:18.644Z", "assignerShortName": "TR-CERT"}, "dataVersion": "5.2"}