Enterprise Architect’s XSLT Debugger processes DOCTYPE declarations that reference external DTDs. A malicious XML file crafted with such a DOCTYPE can cause the parser to expose the contents of arbitrary files on the host system, enabling an attacker to read sensitive data without executing code.

Sparx Systems’ Enterprise Architect is affected. Version 17.1 has been confirmed to implement the vulnerable XSLT Debugger that processes external entity references; other, as‑yet‑unconfirmed versions may also contain the flaw.

The CVSS score of 8.2 indicates high severity, while the EPSS score of less than 1% suggests a low current exploitation likelihood. The vulnerability is not recorded in the CISA KEV catalog. The likely attack vector requires a user to open a crafted XML file; access is local to the privileged user running Enterprise Architect and does not allow remote code execution or privilege escalation.