EUVD-2026-102045
GHSA-2rm5-3xrv-6hxh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted XML/XSLT file to victim
-
DeliveryVictim opens file in XSLT Debugger
-
ExploitParser resolves external DTD entity
-
ExecutionRead arbitrary local files
-
ImpactExfiltrate file contents to attacker
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A02:2025 - Security Misconfiguration
ASVS 5.0
V13 - Configuration XML external entity prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the victim open an attacker-controlled XML/XSLT file specifically within Enterprise Architect's XSLT Debugger feature, and that the file contain a DOCTYPE declaration with an external DTD/entity reference that the parser resolves. Limiting factors: mandatory active user interaction (UI:A) - the attack cannot fire without the victim loading the malicious file, so it depends on social engineering or file delivery rather than a reachable service; impact is limited to reading files accessible to the user's Enterprise Architect process (confidentiality only, no write or code execution from this flaw alone). Confirmed only on version 17.1; other versions are unverified, so defenders cannot assume a given deployment is or isn't affected without vendor confirmation. |
| Impact | This is a genuine but conditional-risk issue, not a drop-everything emergency. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N, score 8.2) encodes the key tension: although privileges are none (PR:N), exploitation is gated on active user interaction (UI:A) - the victim must load an attacker-crafted XML file into the XSLT Debugger. This is therefore not autonomous remote exploitation but a client-side, social-engineering-dependent file-read primitive. Impact is confidentiality-only (VC:H/SC:H), with no integrity or availability effect, consistent with CWE-611 XXE used to exfiltrate arbitrary local files. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so exploitation status is 'no public exploit identified at time of analysis'; there is no signal of active or widespread exploitation. CISA SSVC fields were not provided. Conflicting/soft signals to flag explicitly: the CVSS asserts AV:N, but the actual trigger is a user opening a local file - network vector reflects file delivery (email/download), not a listening service, so treat 'network' loosely. Also, CERT-PL states the flaw is confirmed ONLY in version 17.1 and may affect others because vendor contact failed - affected-version scope is unverified, which should temper both risk scoping and remediation confidence. |
| Exploit ScenarioDerived | An attacker sends a target a crafted .xml/.xslt project file (via email, chat, or a shared repository) and persuades them to open it in Enterprise Architect's XSLT Debugger. The file's DOCTYPE references an external DTD/entity that the parser resolves, causing the application to read local files (e.g., SSH keys, config, source) and disclose them to the attacker. No public exploit code is identified at time of analysis, but XXE payloads for file disclosure are well-documented and trivial to construct. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
XML External Entity injection in Sparx Systems Enterprise Architect's XSLT Debugger lets an attacker who convinces a user to open a crafted XML/XSLT file cause the parser to resolve an external DTD and disclose arbitrary files readable by the victim's Enterprise Architect process. The issue was reported by CERT-PL and has been confirmed only in version 17.1, with all other releases unverified because vendor contact attempts were unsuccessful; the CPE entry covers the product across all versions. It is unauthenticated in the network sense but requires the victim to actively load attacker-controlled content into the debugger (UI:A in the CVSS v4.0 vector, UI:R in our CVSS v3.1 assessment), confidentiality-only impact with no write or code execution demonstrated from this flaw alone, and no public exploit identified at time of analysis.
RemediationAI
No vendor-released patch identified at time of analysis: CERT-PL reported unsuccessful attempts to contact Sparx Systems, so there is currently no fixed build to cite and no confirmed list of safe versions. The most effective short-term control is procedural and immediate: treat every externally sourced XML or XSLT file as untrusted and refuse to open it in the XSLT Debugger, since the attack cannot fire without the victim loading the malicious document - the trade-off is that this blocks legitimate partner-supplied schemas and stylesheets until they are sanitized. Where the XML processing stack permits configuration, disable DOCTYPE processing and external entity resolution (for JAXP-based parsers: enable FEATURE_SECURE_PROCESSING, set the disallow-doctype-decl feature to true, and set external-general-entities and external-parameter-entities to false), accepting that stylesheets relying on DTD-defined entities or default attributes will stop resolving correctly. Reduce blast radius by running Enterprise Architect under a least-privilege account whose file system read access excludes sensitive directories (SSH keys, credential stores, source repositories, shared network drives), recognizing that this only narrows what a successful XXE can exfiltrate and does not eliminate the flaw; additionally consider application allowlisting and endpoint monitoring for unexpected file reads by the Enterprise Architect process, and stay subscribed to https://cert.pl/en/posts/2026/10/CVE-2026-88794 and https://sparxsystems.com/products/ea/ for a patched release, at which point upgrading to the exact vendor-fixed version should take precedence over these compensating controls.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-611 (Improper Restriction of XML External Entity Reference), a classic XXE flaw in the XML parsing stack used by Enterprise Architect's XSLT Debugger feature. When the debugger loads a document, the attacker-supplied DOCTYPE declaration with a SYSTEM reference to an external DTD or entity causes a non-hardened parser to fetch and expand that entity; because the entity URI can point to a local file (for example file:///etc/passwd or a Windows configuration file), the resolved content is surfaced through the debugger's output, error messages, or transform results. XSLT tooling is commonly built on JAXP-style XML processors, where external general entities and DOCTYPE processing are frequently left enabled by default for compatibility with legacy stylesheets, making the debugger a natural delivery vector for this class of bug. The affected product is Sparx Systems Enterprise Architect (CPE cpe:2.3:a:sparx_systems:enterprise_architect:*:*:*:*:*:*:*:*), a widely deployed UML/modeling suite used across enterprise engineering teams, which means it often runs on developer or analyst workstations that hold credentials, source repositories, and configuration files of interest to an attacker. Both the vendor's own CVSS v4.0 score of 8.2 (AV:N/AC:L/AT:N/PR:N/UI:A, VC:H/SC:H) and our independent CVSS v3.1 assessment (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N) agree on high confidentiality impact and no integrity or availability impact; the divergence is only in scoring framework and in the scope/UI terminology, not in the underlying risk picture.
Know when Enterprise Architect gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
User must open a crafted file (UI:R) delivered remotely (AV:N); XXE reads files outside the parser's security authority (S:C) for confidentiality disclosure only (C:H, I/A:N).
Primary rating from Vendor (CERT-PL).
CVSS VectorVendor: CERT-PL
DescriptionCVE.org
Enterprise Architect is vulnerable to XML External Entity (XXE) injection in the XSLT Debugger feature. When a user loads a crafted XML file containing a DOCTYPE with an external DTD reference, the parser processes external entities, allowing an attacker to read arbitrary files from the victim's filesystem.
Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 17.1 but may also affect other versions.
Zero Day Initiative Advisories
Executive ViewAI
Sparx Systems Enterprise Architect users who open crafted XML/XSLT content in the XSLT Debugger could expose files readable by their local Enterprise Architect process, creating a confidentiality risk to sensitive project, configuration, and credential material. The issue is rated HIGH (CVSS 8.2), has been confirmed in version 17.1, and leaves all other releases unverified; no vendor-released patch identified at time of analysis. Leadership should care because developers, architects, and analysts using this tool may inadvertently disclose proprietary or regulated data through a routine file-opening action, and no public exploit identified at time of analysis.
No vendor-released patch identified at time of analysis. Interim mitigations: block or quarantine untrusted XML/XSLT files before they reach users, instruct users not to open unsolicited XML/XSLT content in Sparx Systems Enterprise Architect's XSLT Debugger, run Enterprise Architect with least privilege and restrict its access to sensitive local files, and isolate debugging of untrusted content in a virtual machine or sandbox until a vendor fix is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
XML External Entity (XXE) attacks exploit XML parsers that process Document Type Definitions (DTDs) without proper restrictions.
Exploit-DB