---
id: CVE-2026-18390
title: >-
  Improper neutralization of special elements used in an OS command ('OS command
  injection') vulnerability in Ministry of Justice General Directorate of
  Information Technology UYAP Document Editor on Windows and Linux and Ministry
  of Justi…
summary: >-
  Improper neutralization of special elements used in an OS command ('OS command
  injection') vulnerability in Ministry of Justice General Directorate of
  Information Technology UYAP Document Editor on Windows and Linux and Ministry
  of Justi…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-78
published: '2026-10-12'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T14:17:44.773'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-18390'
references:
  - url: 'https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1299'
    label: iletisim@usom.gov.tr
tags:
  - nvd
  - cve.org
epss: 0.00491
epssPercentile: 0.42002
ingestedAt: '2026-10-12T14:50:34.123Z'
vendor: Ministry of Justice General Directorate of Information Technology
product: UYAP Document Editor
affected:
  - uyap_document_editor < 5.4.20
  - uyap_document_editor < 5.4.21
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-12T14:54:07.569563Z'
---

## Overview

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor on Windows and Linux and Ministry of Justice General Directorate of Information Technology UYAP Document Editor on iOS allows OS Command Injection.

This issue affects UYAP Document Editor: before 5.4.20; UYAP Document Editor: before 5.4.21.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.