This vulnerability (CVE-2026-16999) in the UYAP Document Editor version 4.5.17 involves improper restriction of XML external entity references (CWE-611). This flaw allows serialized data external linking, which could be leveraged by an attacker to access or manipulate external XML entities. The CVSS 3.1 score of 6.3 reflects a medium severity with local attack vector, low attack complexity, no privileges required, and user interaction required. The vulnerability impacts confidentiality but not integrity or availability. No vendor advisory or patch information is currently provided.

The vulnerability can lead to unauthorized disclosure of information through XML external entity processing. It affects confidentiality but does not impact integrity or availability. Exploitation requires local access and user interaction, limiting the attack surface. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should limit exposure by restricting access to the affected version and monitoring for suspicious activity related to XML processing. Avoid opening untrusted XML documents with the affected software.