CVE-2026-88794
8.2HighPublished 15 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Active
- Impact
- High impact on confidentiality
- Weakness
- CWE-611
Impact
Attackers can read arbitrary local files from the victim's filesystem. They need a user to open a crafted XML file in the application's XSLT Debugger.
Root cause
The XSLT Debugger XML parser processes external entity declarations in DOCTYPE headers without disabling external DTD resolution.
Affected systems
Sparx Systems Enterprise Architect version 17.1 confirmed; other versions may also be affected.
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
No vendor patch is currently available; instruct users not to open untrusted XML files using the XSLT Debugger.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Enterprise Architect is vulnerable to XML External Entity (XXE) injection in the XSLT Debugger feature. When a user loads a crafted XML file containing a `DOCTYPE` with an external DTD reference, the parser processes external entities, allowing an attacker to read arbitrary files from the victim's filesystem. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 17.1 but may also affect other versions.