CVE-2026-88794: Enterprise Architect 17.1

Affected technology

Enterprise Architect · 17.1
Sparx Systems

Component: XSLT Debugger

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · Active user interaction

What an attacker can do

The source says when a user loads a crafted XML file containing a `DOCTYPE` with an external DTD reference, the parser processes external entities, allowing an attacker to read arbitrary files from the victim's filesystem. Vendor/CNA’s CVSS 4.0 assessment (base score 8.2/10) rates confidentiality impact as high; integrity and availability impact as none.