CVE-2026-12613

HighCVSS 8.8/10Last modified Oct 14, 2026

Description

Deserialization of untrusted data vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor on Windows and Linux and Ministry of Justice General Directorate of Information Technology UYAP Document Editor on MacOS allows Object Injection.

This issue affects UYAP Document Editor: before 5.4.20; UYAP Document Editor: before 5.4.21.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
Ministry of Justice General Directorate of Information Technology	UYAP Document Editor	< 5.4.20
Ministry of Justice General Directorate of Information Technology	UYAP Document Editor	< 5.4.21

References

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1299

Timeline

Published: Oct 12, 2026
Last modified: Oct 14, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-126132When a message was forwarded inline, edited as new, or had an attachment dragged into a compose window, a specially crafted link attachment CVE-2026-126133When a CalDAV or ICS calendar was accessed through an HTTP proxy that requested authentication, Thunderbird could answer the proxy with the CVE-2026-126134Thunderbird allowed feed subscriptions to file: URLs that point to a network share. If a user was tricked into subscribing to such a URL, Th CVE-2026-126135If an attacker was able to perform a man-in-the-middle attack on an SMTP or POP3 server connection using STARTTLS, the attacker could inject CVE-2026-126136For Exchange accounts using EWS or Microsoft Graph with OAuth2 authentication, Thunderbird sent the OAuth2 access token to the server even w CVE-2026-1261448.8A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 throu CVE-2026-1261457.2A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 throu CVE-2026-1261467.2A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 throu CVE-2026-1261479.8A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, Fo CVE-2026-1261489.8A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 throu CVE-2026-1261497.5A integer overflow or wraparound vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 thr CVE-2026-1261509.1A weak password recovery mechanism for forgotten password vulnerability in Fortinet FortiMail 8.0.0, FortiMail 7.6.0 through 7.6.5, FortiMai