XML External Entity Injection in Enterprise Architect by Sparx Systems
CVE-2026-88794

8.2HIGH

Key Information:

Vendor

Sparx Systems

Status
Enterprise Architect
Vendor
CVE Published:
15 October 2026

What is CVE-2026-88794?

Enterprise Architect is susceptible to an XML External Entity (XXE) injection in its XSLT Debugger feature. This risk arises when a user loads a specifically crafted XML file containing a DOCTYPE declaration with an external DTD reference. The vulnerability permits the parser to process external entities, potentially granting attackers the capability to read arbitrary files from the victim’s filesystem. While this issue has been confirmed in version 17.1, it is advisable for users to verify other versions for similar risks as attempts to contact the vendor for clarification have been unsuccessful.

Affected Version(s)

Enterprise Architect 17.1

References

https://cert.pl/en/posts/2026/10/CVE-2026-88794
third-party-advisory
https://sparxsystems.com/products/ea/
product

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Hlib Yavorskyi working with TrendAI Zero Day Initiative
.