{"cve":"CVE-2026-88794","nvd":{"published":"2026-10-15T13:17:13.837","modified":"2026-10-16T16:00:33.533","status":"Awaiting Analysis","description":"Enterprise Architect is vulnerable to XML External Entity (XXE) injection in the XSLT Debugger feature. When a user loads a crafted XML file containing a `DOCTYPE` with an external DTD reference, the parser processes external entities, allowing an attacker to read arbitrary files from the victim's filesystem.\n\nBecause vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 17.1 but may also affect other versions.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","score":8.2},"cvss_v3":null,"cwes":["CWE-611"],"references":["https://cert.pl/en/posts/2026/10/CVE-2026-88794","https://sparxsystems.com/products/ea/"],"products":[],"source":"nvd","synced_at":"2026-10-19T23:00:53.604569364+00:00"},"epss":{"cve":"CVE-2026-88794","score":0.00332,"percentile":0.26162,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}