---
id: CVE-2026-18390
title: >-
  Improper neutralization of special elements used in an OS command ('OS command
  injection') vulnerability in Ministry of Justice General Directorate of
  Information Technology UYAP Document Editor allows OS Command Injection.


  This issue a…
summary: >-
  Improper neutralization of special elements used in an OS command ('OS command
  injection') vulnerability in Ministry of Justice General Directorate of
  Information Technology UYAP Document Editor allows OS Command Injection.


  This issue a…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-78
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T15:17:09.170'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-18390'
references:
  - url: 'https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1299'
    label: iletisim@usom.gov.tr
tags:
  - nvd
ingestedAt: '2026-10-12T14:50:34.123Z'
---

## Overview

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor allows OS Command Injection.

This issue affects UYAP Document Editor: before 5.4.20.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.