CVE-2025-40934

9.3 CRITICAL
Published: November 26, 2025 Modified: December 01, 2025

Description

XML-Sig versions 0.27 through 0.67 for Perl incorrectly validates XML files if signatures are omitted. An attacker can remove the signature from the XML document to make it pass the verification check. XML-Sig is a Perl module to validate signatures on XML files.  An unsigned XML file should return an error message.  The affected versions return true when attempting to validate an XML file that contains no signatures.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

CVSS v3.x Details

0.0 Low Medium High Critical 10.0
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
https://github.com/perl-net-saml2/perl-XML-Sig/issues/63
Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e
https://github.com/perl-net-saml2/perl-XML-Sig/pull/64
Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e

2 reference(s) from NVD

Quick Stats

CVSS v3 Score
9.3 / 10.0
EPSS (Exploit Probability)
0.0%
3th percentile
Exploitation Status
Not in CISA KEV

Weaknesses (CWE)