CVE-2026-12613: CWE-502 Deserialization of untrusted data in Ministry of Justice General Directorate of Information Technology UYAP Document Editor

CVE-2026-12613 is a deserialization of untrusted data vulnerability in the UYAP Document Editor produced by the Ministry of Justice General Directorate of Information Technology. The flaw allows an attacker to perform object injection by exploiting unsafe deserialization processes. This can lead to compromise of confidentiality, integrity, and availability of the affected system. The vulnerability affects all versions prior to 5.4.20. The CVSS v3.1 base score is 8.8, indicating a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. No official patch or remediation information is provided in the data.

Successful exploitation of this vulnerability can lead to full compromise of the affected system's confidentiality, integrity, and availability. An attacker could inject malicious objects during deserialization, potentially executing arbitrary code or causing denial of service. The high CVSS score reflects the significant risk posed by this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor the Ministry of Justice General Directorate of Information Technology's advisories for updates. Until a fix is available, avoid processing untrusted serialized data with the affected UYAP Document Editor versions.