CVE-2026-18390

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-18390", "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "state": "PUBLISHED", "assignerShortName": "TR-CERT", "dateReserved": "2026-07-30T14:09:31.322Z", "datePublished": "2026-10-12T13:57:33.532Z", "dateUpdated": "2026-10-14T13:23:10.391Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2026-10-14T13:23:10.391Z"}, "title": "Command Injection in Ministry of Justice's UYAP Document Editor", "datePublic": "2026-10-12T13:53:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-78", "description": "CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-88", "descriptions": [{"lang": "en", "value": "CAPEC-88 OS Command Injection"}]}], "affected": [{"vendor": "Ministry of Justice General Directorate of Information Technology", "product": "UYAP Document Editor", "platforms": ["Windows", "Linux"], "versions": [{"status": "affected", "version": "0", "lessThan": "5.4.20", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Ministry of Justice General Directorate of Information Technology", "product": "UYAP Document Editor", "platforms": ["iOS"], "versions": [{"status": "affected", "version": "0", "lessThan": "5.4.21", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor on Windows and Linux and Ministry of Justice General Directorate of Information Technology UYAP Document Editor on iOS allows OS Command Injection.\n\nThis issue affects UYAP Document Editor: before 5.4.20; UYAP Document Editor: before 5.4.21.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor on Windows and Linux and Ministry of Justice General Directorate of Information Technology UYAP Document Editor on iOS allows OS Command Injection.<p>This issue affects UYAP Document Editor: before 5.4.20; UYAP Document Editor: before 5.4.21.</p>"}]}], "references": [{"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1299", "tags": ["government-resource"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}}], "credits": [{"lang": "en", "value": "Mustafa An\u0131l YILDIRIM", "type": "finder"}], "source": {"defect": ["TR-26-1299"], "advisory": "TR-26-1299", "discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-12T14:54:07.569563Z", "id": "CVE-2026-18390", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-12T14:54:14.967Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-18390", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-12T14:54:07.569563Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-12T14:54:11.891Z"}}], "cna": {"title": "Command Injection in Ministry of Justice's UYAP Document Editor", "source": {"defect": ["TR-26-1299"], "advisory": "TR-26-1299", "discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Mustafa An\u0131l YILDIRIM"}], "impacts": [{"capecId": "CAPEC-88", "descriptions": [{"lang": "en", "value": "CAPEC-88 OS Command Injection"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Ministry of Justice General Directorate of Information Technology", "product": "UYAP Document Editor", "versions": [{"status": "affected", "version": "0", "lessThan": "5.4.20", "versionType": "semver"}], "platforms": ["Windows", "Linux"], "defaultStatus": "unaffected"}, {"vendor": "Ministry of Justice General Directorate of Information Technology", "product": "UYAP Document Editor", "versions": [{"status": "affected", "version": "0", "lessThan": "5.4.21", "versionType": "semver"}], "platforms": ["iOS"], "defaultStatus": "unaffected"}], "datePublic": "2026-10-12T13:53:00.000Z", "references": [{"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1299", "tags": ["government-resource"]}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor on Windows and Linux and Ministry of Justice General Directorate of Information Technology UYAP Document Editor on iOS allows OS Command Injection.\n\nThis issue affects UYAP Document Editor: before 5.4.20; UYAP Document Editor: before 5.4.21.", "supportingMedia": [{"type": "text/html", "value": "Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor on Windows and Linux and Ministry of Justice General Directorate of Information Technology UYAP Document Editor on iOS allows OS Command Injection.<p>This issue affects UYAP Document Editor: before 5.4.20; UYAP Document Editor: before 5.4.21.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')"}]}], "providerMetadata": {"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "shortName": "TR-CERT", "dateUpdated": "2026-10-14T13:23:10.391Z"}}}, "cveMetadata": {"cveId": "CVE-2026-18390", "state": "PUBLISHED", "dateUpdated": "2026-10-14T13:23:10.391Z", "dateReserved": "2026-07-30T14:09:31.322Z", "assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21", "datePublished": "2026-10-12T13:57:33.532Z", "assignerShortName": "TR-CERT"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Windows", "Linux"], "product": "UYAP Document Editor", "vendor": "Ministry of Justice General Directorate of Information Technology", "versions": [{"lessThan": "5.4.20", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "platforms": ["iOS"], "product": "UYAP Document Editor", "vendor": "Ministry of Justice General Directorate of Information Technology", "versions": [{"lessThan": "5.4.21", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "iletisim@usom.gov.tr"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor on Windows and Linux and Ministry of Justice General Directorate of Information Technology UYAP Document Editor on iOS allows OS Command Injection.\n\nThis issue affects UYAP Document Editor: before 5.4.20; UYAP Document Editor: before 5.4.21."}], "id": "CVE-2026-18390", "lastModified": "2026-10-14T14:17:44.773", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "iletisim@usom.gov.tr", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18390", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-12T14:54:07.569563Z", "version": "2.0.3"}}]}, "published": "2026-10-12T14:17:12.563", "references": [{"source": "iletisim@usom.gov.tr", "url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1299"}], "sourceIdentifier": "iletisim@usom.gov.tr", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "iletisim@usom.gov.tr", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,5.4.20)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "UYAP Document Editor", "source": "cna", "vendor": "Ministry of Justice General Directorate of Information Technology"}, "product": "uyap_document_editor", "vendor": "ministry_of_justice"}], "created": "2026-10-12T15:45:13.401103+00:00", "updated": "2026-10-17T08:15:05.161379+00:00", "vendors": ["ministry_of_justice", "ministry_of_justice$PRODUCT$uyap_document_editor"]}