Which versions of Sparx Pro Cloud Server are affected by CVE-2026-42099?

Sparx Systems Pro Cloud Server versions 0 through 6.1 build 167 contain a race condition allowing authenticated users to execute arbitrary code and compromise the entire server.

How to fix or mitigate CVE-2026-42099?

Within 24 hours: Inventory all Sparx Systems Pro Cloud Server instances, document versions, and restrict network access to the server to trusted IP addresses only. Within 7 days: Reduce the authenticated user base to essential personnel only; enable detailed audit logging on the /data_api/dl_internal_artifact.php endpoint; implement network segmentation isolating the server. Within 30 days: Contact Sparx Systems for patch availability and timeline; if no patch is available within 90 days, evaluate alternative products and plan migration.

Sparx Pro Cloud Server CVE-2026-42099

Q: What is the CVSS score of CVE-2026-42099?

CVE-2026-42099 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-30929 HIGH

Race Condition (CWE-362)

2026-05-19 CERT-PL

GHSA-qff4-m3j5-xcv5

PHP Race Condition RCE

7.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.7 HIGH

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 19, 2026 - 14:31 vuln.today

DescriptionCVE.org

Sparx Pro Cloud Server is vulnerable to a Race Condition in the /data_api/dl_internal_artifact.php endpoint. The application downloads the properties of the object pointed by guid parameter and saves loaded content in current location (__DIR__) under the specified name. An attacker with repository access can control both the filename and file contents, allowing the creation of a malicious PHP file in a current directory. Although the file is deleted after processing, a race condition exists: if the response transmission is delayed (e.g., via a large file or slow client connection), the file remains accessible. During this window, the attacker can issue a second request to execute the malicious PHP file, resulting in remote code execution.

The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.1 (build 167) and below were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.

AnalysisAI

Remote code execution in Sparx Systems Pro Cloud Server (versions 0 through 6.1 build 167) is achievable by authenticated repository users via a race condition in the /data_api/dl_internal_artifact.php endpoint. An attacker who controls both the filename and contents of a downloaded artifact can briefly stage a malicious PHP file in the web root and execute it before cleanup, leading to full server compromise. No public exploit identified at time of analysis, but a detailed technical write-up published by CERT-PL and sploit.tech reduces the barrier to reproduction.

Technical ContextAI

The vulnerability resides in a PHP-based artifact download handler in Sparx Pro Cloud Server, a collaborative repository backend for Sparx Enterprise Architect modeling tools (CPE: cpe:2.3:a:sparx_systems:pro_cloud_server). The endpoint dl_internal_artifact.php fetches an object identified by the guid parameter and writes its contents to __DIR__ (the current script directory inside the web-accessible PHP application) using an attacker-controlled filename. The root cause is CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization, aka TOCTOU): the write-then-delete sequence is not atomic with respect to concurrent HTTP requests, leaving a window where the file is present and executable by the PHP interpreter. Because the file lands inside a PHP-served directory rather than an isolated quarantine path, any window of exposure becomes code-execution-capable.

RemediationAI

No vendor-released patch identified at time of analysis - Sparx Systems did not respond to coordinated disclosure by CERT-PL, so administrators should contact the vendor directly for a fixed build and monitor https://sparxsystems.com/products/procloudserver/ for updates. As compensating controls, restrict network access to /data_api/dl_internal_artifact.php at a reverse proxy or WAF layer so that only trusted client IPs can reach it (side effect: may break legitimate remote Enterprise Architect clients that need the artifact API); tighten repository account provisioning and audit who currently holds repository access, since exploitation requires PR:L; and where feasible, configure the PHP runtime or web server to deny execution of .php files written to artifact-handling directories (side effect: may break legitimate features that rely on dynamic PHP in those paths). Refer to the technical advisories at https://cert.pl/en/posts/2026/05/CVE-2026-42096, https://sploit.tech/2026/05/19/Sparx-Enterprise-Architect-PCS.html, and https://efigo.pl/blog/CVE-2026-42096/ for detection guidance.