Sparx Enterprise Architect XXE Flaw: Unpatched Debugger Enables Arbitrary File Read via Crafted Documents
A flaw in the XSLT Debugger allows attackers to read files if users open crafted documents, posing a risk to unpatched versions.
Key points
- CVE-2026-88794 affects Sparx Systems Enterprise Architect 17.1 due to XML External Entity injection.
- Attackers can read arbitrary files from the victim's filesystem through the debugger feature.
- No vendor patch exists; Zero Day Initiative rated the CVSS score at 5.5 while NVD lists 8.2.
An attacker who convinces a user to open a malicious file can read sensitive data from the local machine. The vulnerability resides in Sparx Systems Enterprise Architect 17.1, specifically within the XSLT Debugger component. By processing external entities defined in crafted XML documents, the application exposes the contents of arbitrary files to the attacker, effectively disclosing information stored on the victim's system.
How it unfolded
- Zero Day Initiative reported the issue to the vendor via a web form on July 24, 2026.
- ZDI emailed the vendor directly on July 29, 2026, seeking a secure contact for the report.
- After receiving no response, ZDI reported the case to CERT.PL’s coordinated disclosure program on August 6, 2026.
- CERT.PL verified the issue and assigned a CVE on October 6, 2026.
- ZDI and CERT.PL coordinated the publication of the zero-day advisory on October 15, 2026.
Who is affected
Sparx Systems Enterprise Architect 17.1 is confirmed vulnerable to this XML External Entity injection flaw. Because attempts to contact the vendor were unsuccessful, it is unclear if other versions are affected, though the risk likely extends beyond the confirmed release. The National Vulnerability Database rates the severity as high with a CVSS score of 8.2, while the Zero Day Initiative assigns a score of 5.5.
The fix
No patch or update has been confirmed by the vendor. Zero Day Initiative notes that vendor contact attempts were unsuccessful, leading to public disclosure through CERT.PL. Users must rely on mitigation strategies such as restricting interaction with the product until a fix is available.
What made it possible
This flaw stems from improper restriction of XML External Entity references. When an XML parser fails to block external definitions, it can fetch and process data from unintended sources. In intrusion scenarios, this technique often serves as an initial foothold for information disclosure. Teams usually monitor for unexpected file access during parsing events. Check whether applications validate document structures before processing. Restricting access to local resources during XML handling reduces exposure. Ensure that debug tools do not execute untrusted content in production environments. This approach helps contain potential data leaks before they escalate into broader compromises.
What to do and how to stay safe: Sparx Systems
- Restrict access to Enterprise Architect instances and limit who can open files in the debugger.
- Monitor for unusual file access patterns that may indicate exploitation attempts.
- Train users to avoid opening XML or XSLT files from untrusted sources.
- Review network logs for unexpected outbound requests from the application.
Step-by-step guide: What Is Virtual Patching: How It Works Without Code Changes
General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-88794?
It is a vulnerability in Sparx Systems Enterprise Architect 17.1 that allows XML External Entity injection.
How is the vulnerability exploited?
A user must open a crafted XML file or visit a malicious page containing external DTD references.
Is there a patch available?
No fix has been confirmed yet, as vendor contact attempts were unsuccessful.
