Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Ministry of Justice General Directorate… (CVE-2026-18390)

This vulnerability (CVE-2026-18390) involves improper neutralization of special elements used in OS commands within the UYAP Document Editor software. This flaw allows an attacker to perform OS command injection, potentially leading to high impact on confidentiality, integrity, and availability. The affected versions are those before 5.4.20. The CVSS 3.1 vector indicates the attack requires local access with low complexity, no privileges, and user interaction, but results in high impact across all security objectives. There is no information about available patches or vendor advisories.

Successful exploitation could allow an attacker to execute arbitrary OS commands on the affected system, leading to full compromise of confidentiality, integrity, and availability of the system running UYAP Document Editor. The vulnerability is rated high severity with a CVSS score of 7.8, indicating significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to trusted users only and avoid executing untrusted input through the UYAP Document Editor. Monitor for vendor updates regarding patches or mitigations.