ZDI Discloses Unpatched Sparx Enterprise Architect XXE Flaw Allowing Local File Access
A high-severity XML External Entity vulnerability in Sparx Enterprise Architect 17.1 lets attackers access local files, with no vendor patch confirmed yet.
Key points
- CVE-2026-88794 affects Sparx Enterprise Architect 17.1 via the XSLT Debugger feature.
- Attackers can read arbitrary files from the victim's filesystem using crafted XML documents.
- The Zero Day Initiative reports that vendor contact attempts were unsuccessful prior to disclosure.
The Zero Day Initiative disclosed a high-severity information disclosure vulnerability in Sparx Systems Enterprise Architect on October 15, 2026, after the vendor failed to respond to multiple security reports. The flaw, tracked as CVE-2026-88794, allows remote attackers to access sensitive data on affected installations through improper handling of XML External Entity references in the XSLT Debugger component.
At a glance
- CVE
- CVE-2026-88794
- Product
- Sparx Systems Enterprise Architect
- CVSS
- 8.2 High
- Weakness
- XML external entity
- Exploited
- No known exploitation
According to the National Vulnerability Database, the flaw carries a CVSS score of 8.2, classified as high severity. The vulnerability stems from CWE-611, where the application processes external entities defined in a crafted XML file’s DOCTYPE. This processing enables an attacker to read arbitrary files from the victim’s local filesystem, potentially exposing sensitive configuration data or credentials stored on the machine running the software.
Context and Background
The Zero Day Initiative initially attempted to report the vulnerability to Sparx Systems on July 24, 2026, via the vendor’s bug report webform. When no response was received, ZDI emailed the vendor directly on July 29, 2026, requesting a secure contact for the report. After continued silence, ZDI reported the case to CERT.PL’s coordinated disclosure program on August 6, 2026.
CERT.PL verified the reported issue on October 6, 2026, and assigned the CVE identifier. The Zero Day Initiative and CERT.PL coordinated the publication of the zero-day advisory on October 15, 2026. The ZDI notes that user interaction is required to exploit this vulnerability, meaning the target must visit a malicious page or open a malicious file containing the crafted XML document.
Who Is Affected
The vulnerability has been confirmed in Sparx Systems Enterprise Architect version 17.1. Because the vendor did not respond to contact attempts, the scope of affected versions remains unclear. The NVD record states that while the flaw is confirmed in 17.1, it may also affect other versions of the software. Organizations using this modeling and design tool should assume their installations are at risk until further notice.
The Zero Day Initiative assigns a CVSS rating of 5.5 to the vulnerability, noting that an attacker can leverage the flaw to disclose information in the context of the current process. This discrepancy in severity ratings highlights the potential impact depending on the sensitivity of the files accessible by the application’s process.
What should you do?
Given the nature of the vulnerability and the lack of a vendor patch, the Zero Day Initiative advises restricting interaction with the product as the primary mitigation strategy. Users should avoid opening XML files from untrusted sources or visiting unknown links while using the Enterprise Architect application. Administrators should monitor for any official statements from Sparx Systems regarding updates or workarounds for CVE-2026-88794.
What to do and how to stay safe: Sparx Systems
- Avoid opening XML files or XSLT documents from untrusted sources in Enterprise Architect.
- Restrict user access to the XSLT Debugger feature if it is not essential for daily workflows.
- Monitor the Zero Day Initiative and NVD pages for updates on patches or additional mitigation guidance.
- Review file system permissions to limit the scope of data accessible by the application process.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-88794?
CVE-2026-88794 is an XML External Entity injection vulnerability in Sparx Enterprise Architect 17.1 that allows attackers to read local files via the XSLT Debugger.
Is there a patch available for this vulnerability?
No patch has been confirmed yet, as the vendor did not respond to security reports from the Zero Day Initiative prior to disclosure.
How can this vulnerability be exploited?
An attacker can exploit this by tricking a user into opening a malicious XML file or visiting a malicious page, which triggers the parser to read local files.
