---
id: CVE-2026-12613
title: >-
  Deserialization of untrusted data vulnerability in Ministry of Justice General
  Directorate of Information Technology UYAP Document Editor on Windows and
  Linux and Ministry of Justice General Directorate of Information Technology
  UYAP Doc…
summary: >-
  Deserialization of untrusted data vulnerability in Ministry of Justice General
  Directorate of Information Technology UYAP Document Editor on Windows and
  Linux and Ministry of Justice General Directorate of Information Technology
  UYAP Doc…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-502
published: '2026-10-12'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T14:17:44.287'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-12613'
references:
  - url: 'https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1299'
    label: iletisim@usom.gov.tr
tags:
  - nvd
  - cve.org
epss: 0.00252
epssPercentile: 0.16599
ingestedAt: '2026-10-12T14:50:34.123Z'
vendor: Ministry of Justice General Directorate of Information Technology
product: UYAP Document Editor
affected:
  - uyap_document_editor < 5.4.20
  - uyap_document_editor < 5.4.21
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-12T14:53:43.648412Z'
---

## Overview

Deserialization of untrusted data vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor on Windows and Linux and Ministry of Justice General Directorate of Information Technology UYAP Document Editor on MacOS allows Object Injection.

This issue affects UYAP Document Editor: before 5.4.20; UYAP Document Editor: before 5.4.21.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.