CVE-2026-16999 describes an improper restriction of XML external entity references in the Ministry of Justice UYAP Document Editor. This vulnerability affects versions from 4.5.17 before 5.4.17 and is categorized under CWE-611 (Improper Restriction of XML External Entity Reference). The issue allows serialized data external linking, which can lead to unauthorized disclosure of confidential information. The CVSS 3.1 vector indicates the attack requires local access (AV:L), low attack complexity (AC:L), no privileges required (PR:N), user interaction required (UI:R), and scope change (S:C). The impact is high confidentiality loss (C:H) with no impact on integrity or availability.

Successful exploitation can lead to unauthorized disclosure of sensitive information due to the improper handling of XML external entities. The vulnerability does not affect data integrity or availability. The attack requires local access and user interaction, limiting the attack surface somewhat. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently provided. Users should monitor for vendor updates and apply patches once available. Until then, restricting local access and minimizing user interaction with untrusted XML content may reduce risk.