The updated CVE description confirms an OS command injection flaw in the UYAP Document Editor. The application improperly handles user‑supplied input, forwarding it directly to the operating‑system's command interpreter without sanitization. This weakness (CWE‑78) allows an attacker who can submit crafted data through the editor to execute arbitrary shell commands. Successful exploitation could lead to remote code execution, data exfiltration or full system compromise, affecting confidentiality, integrity and availability.

The flaw is present in the UYAP Document Editor used by the Ministry of Justice General Directorate of Information Technology. All running a version earlier than 5.4.20 are vulnerable.

The vulnerability has a CVSS v3 score of 7.8, indicating a high potential for damage if exploited. The EPSS score is < 1%, and the issue is not listed in CISA’s KEV catalog, implying no known widespread active exploitation but still posing a significant risk. The attack vector is likely to involve a malicious user supplying crafted input through the document editor, which the application forwards to the operating system’s command interpreter. If an attacker can execute commands, they can gain system‑level privileges or otherwise compromise the affected environment.