CVE-2026-16999 MEDIUM

CVE-2026-16999: XXE in Ministry of Justice's UYAP Document Editor

Vendor Ministry Of Justice
Product UYAP Document Editor
Weakness CWE-611 · XXE
Published August 12, 2026
Last update August 12, 2026
View on NVD All CVEs

CVSS base score

6.3/10
Attack vector Local
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

What the vulnerability does

01Description

Improper restriction of XML external entity reference vulnerability in Ministry of Justice UYAP Document Editor allows Serialized Data External Linking. This issue affects UYAP Document Editor: from 4.5.17 before 5.4.17.

Key dates

02Disclosure timeline

August 12, 2026 CVE published

Related vulnerabilities

04Related CVE

CVE-2025-31039 WordPress Category Icon plugin <= 1.0.3 - XML External Entity (XXE) vulnerability CVE-2025-32138 WordPress Easy Google Maps plugin <= 1.11.18 - XML External Entity vulnerability CVE-2024-50442 WordPress Royal Elementor Addons and Templates plugin <= 1.3.980 - XML External Entity (XXE) vulnerability CVE-2021-29447 WordPress Authenticated XXE attack when installation is running PHP 8 CVE-2025-14478 Demo Importer Plus <= 2.0.9 - Authenticated (Author+) Blind XML External Entity Injection via SVG File Upload