PT-2025-49776 · Unknown+1 · Xmlseclibs+1

Published 2025-12-09 · Updated 2025-12-11 · CVE-2025-66578

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions xmlseclibs versions prior to 3.1.4

Description xmlseclibs is a PHP library used for XML Encryption and Signatures. Versions of the library before 3.1.4 contain a flaw in the libxml2 canonicalization process during document transformation that can lead to an authentication bypass. Specifically, when libxml2’s canonicalization is applied to invalid XML input, it may return an empty string instead of a canonicalized node. xmlseclibs then calculates the DigestValue based on this empty string, incorrectly assuming successful canonicalization.

Recommendations Update to version 3.1.4 or later. Treat canonicalization failures (exceptions or nil/empty outputs) as fatal and abort validation. Add explicit checks to reject when canonicalization returns nil/empty or raises errors.

Exploit

Fix

Weakness Enumeration

CWE-248

Related Identifiers

CVE-2025-66578

GHSA-C4CC-X928-VJW9

Affected Products

Libxml2

Xmlseclibs

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66578.json · Exploit
• 🔥 https://github.com/robrichards/xmlseclibs/security/advisories/GHSA-c4cc-x928-vjw9 · Exploit
• https://github.com/robrichards/xmlseclibs/commit/69fd63080bc47a8d51bc101c30b7cb756862d1d6 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-66578 · Security Note
• https://osv.dev/vulnerability/CVE-2025-66578 · Vendor Advisory
• https://github.com/robrichards/xmlseclibs/blob/f4131320c6dcd460f1b0c67f16f8bf24ce4b5c3e/src/XMLSecurityDSig.php#L296 · Note
• https://twitter.com/CVEnew/status/1998225329299849561 · Twitter Post
• https://twitter.com/dailycve/status/1999168101275857045 · Twitter Post
• https://t.me/CVEtracker/39203 · Telegram Post