Vulnerability details
CVE-2025-40934
TIMLEGGE XML::Sig
XML-Sig prior to 0.68 for Perl improperly validates XML without signatures
CVSS 3.1
9.3Critical
Official description
XML-Sig versions 0.27 through 0.67 for Perl incorrectly validates XML files if signatures are omitted. An attacker can remove the signature from the XML document to make it pass the verification check. XML-Sig is a Perl module to validate signatures on XML files. An unsigned XML file should return an error message. The affected versions return true when attempting to validate an XML file that contains no signatures.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.3Critical | 3.1 | CISA ADP / Vulnrichment (CISA-ADP) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| TIMLEGGE | XML::Sig | 0.27 ≤ v < 0.68 | CVEProject cvelistV5 (CNA) |
References and advisories
2
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2025-11-27
- Last updated
- 2025-11-28
- State
- Published
- Assigner (CNA)
- CPANSec
Exploit prediction (EPSS)
0.17%
Probability of exploitation in 30 days
7.2%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-347Improper Verification of Cryptographic Signature