Full Report
Improper restriction of XML external entity reference vulnerability (CVE-2026-88794) has been found in Sparx Systems Enterprise Architect software.
Analysis Summary
# Vulnerability: XXE Injection in Sparx Systems Enterprise Architect XSLT Debugger
## CVE Details
- **CVE ID:** CVE-2026-88794
- **CVSS Score:** Not explicitly rated in the report (Typically High/Critical for XXE)
- **CWE:** CWE-611: Improper Restriction of XML External Entity Reference
## Affected Systems
- **Products:** Sparx Systems Enterprise Architect
- **Versions:** Confirmed in version 17.1; other versions may also be affected.
- **Configurations:** Systems where the XSLT Debugger feature is utilized.
## Vulnerability Description
The vulnerability exists within the **XSLT Debugger** feature of Sparx Systems Enterprise Architect. The software's XML parser fails to properly restrict external entity references when processing a crafted XML file. Specifically, if a user loads an XML file containing a `DOCTYPE` declaration with an external Document Type Definition (DTD) reference, the parser will process the external entity. This allows an attacker to perform an XML External Entity (XXE) injection.
## Exploitation
- **Status:** Vulnerability confirmed and disclosed; no report of exploitation in the wild at this time.
- **Complexity:** Medium (Requires a user to open/load a malicious XML file).
- **Attack Vector:** Network/Local (File-based interaction).
## Impact
- **Confidentiality:** High (Attacker can read arbitrary files from the victim's local filesystem).
- **Integrity:** Low/None.
- **Availability:** Low/None (Unless targeted for Denial of Service via billion laughs attack).
## Remediation
### Patches
- **Status:** No patch currently available. The vendor (Sparx Systems) reportedly did not respond to contact attempts by CERT Polska during the disclosure process.
### Workarounds
- **Feature Restriction:** Avoid using the XSLT Debugger feature with XML files from untrusted or external sources.
- **File Validation:** Manually inspect XML files for `DOCTYPE` declarations and external entity references before opening them in Enterprise Architect.
## Detection
- **Indicators of Compromise:** Unusual outbound network requests (DNS/HTTP) initiated by the `EA.exe` process to unknown external IP addresses, which may indicate an attempt to exfiltrate file data.
- **Detection Methods:** Security teams can use EDR tools to monitor for file access patterns where Enterprise Architect accesses sensitive system files (e.g., `/etc/passwd` or `C:\Windows\win.ini`).
## References
- **CERT Polska Advisory:** hxxps[://]cert[.]pl/en/posts/2026/10/vulnerability-in-sparx-systems-enterprise-architect/
- **CVE Record:** hxxps[://]www[.]cve[.]org/CVERecord?id=CVE-2026-88794
- **CWE-611 Info:** hxxps[://]cwe[.]mitre[.]org/data/definitions/611[.]html