CVE-2026-88794
XML External Entity injection in Sparx Enterprise Architect
- State
- Published
- Severity
- 8.2 High
- Published
- Oct 15, 2026
- Updated
- Oct 15, 2026
- Reserved
- Sep 10, 2026
Description
Enterprise Architect is vulnerable to XML External Entity (XXE) injection in the XSLT Debugger feature. When a user loads a crafted XML file containing a `DOCTYPE` with an external DTD reference, the parser processes external entities, allowing an attacker to read arbitrary files from the victim's filesystem.
Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 17.1 but may also affect other versions.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.2 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N | CERT-PL |
Weaknesses
- CWE-611 Improper restriction of XML external entity reference
Affected Products
| Product | Versions |
|---|---|
Enterprise ArchitectSparx Systems |
|
References
- https://cert.pl/en/posts/2026/10/CVE-2026-88794third-party-advisory
- https://sparxsystems.com/products/ea/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.