PT-2025-48197 · Xml-Sig · Xml::Sig

Gttds · Published 2025-11-26 · Updated 2025-12-30 · CVE-2025-40934

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions XML-Sig versions 0.27 through 0.67

Description The Perl module XML-Sig does not correctly validate XML files when signatures are absent. An attacker can remove a signature from an XML document, causing the verification check to pass incorrectly. An unsigned XML file should normally return an error, but the affected versions return a successful validation result when no signature is present.

Recommendations Update to a version of XML-Sig greater than 0.67.

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2025-40934

Affected Products

Xml::Sig

References · 8

• https://github.com/perl-net-saml2/perl-XML-Sig/pull/64 · Patch
• https://github.com/perl-net-saml2/perl-XML-Sig/issues/63 · Patch
• https://osv.dev/vulnerability/CVE-2025-40934 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-40934 · Security Note
• https://t.me/CVEtracker/38333 · Telegram Post
• https://t.me/cveNotify/147140 · Telegram Post
• https://twitter.com/CVEnew/status/1993814641881882763 · Twitter Post
• https://t.me/cveNotify/144285 · Telegram Post