Vulnerability in Timlegge Xml::sig
CVE-2025-40934
XML-Sig versions 0.27 through 0.67 for Perl incorrectly validates XML files if signatures are omitted. An attacker can remove the signature from the XML document to make it pass the verification check. XML-Sig is a Perl module to validate signatures on XML files. An unsigned XML file should return an error message. The affected versions return true when attempting to validate an XML file that contains no signatures.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.3 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N.
EPSS exploit prediction
EPSS: 0.002 (7.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 7th percentile — 7.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: +0.000
Affected products
- Timlegge Xml::sig — versions 0.27
- XML\ \ — versions sig_project
- Xml\:\:sig Project
Weakness classification (CWE)
References
- 9b29abf9-4ab0-4765-b253-1875cd9b441e (issue-tracking, Patch, Issue Tracking)
- 9b29abf9-4ab0-4765-b253-1875cd9b441e (patch, Issue Tracking)
Frequently asked questions
- What is CVE-2025-40934?
- CVE-2025-40934 is a critical-severity vulnerability in Timlegge Xml::sig, classified under Improper Verification of Cryptographic Signature. CVSS score: 9.3/10. Published 2025-11-26.
- How severe is CVE-2025-40934?
- Critical severity. CVSS v3 base score is 9.3 out of 10.