Critical severity · published Nov 26, 2025
CVE-2025-40934
XML-Sig prior to 0.68 for Perl improperly validates XML without signatures
9.3
CVSS
0.2%
EPSS
No
On KEV
Description
XML-Sig versions 0.27 through 0.67 for Perl incorrectly validates XML files if signatures are omitted.
An attacker can remove the signature from the XML document to make it pass the verification check.
XML-Sig is a Perl module to validate signatures on XML files. An unsigned XML file should return an error message. The affected versions return true when attempting to validate an XML file that contains no signatures.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
High
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
XM
XML::Sig · TIMLEGGE
0.27 before 0.68 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-40934
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-40934
Issue Tracking
https://github.com/perl-net-saml2/perl-XML-Sig/issues/63
Issue Tracking
https://github.com/perl-net-saml2/perl-XML-Sig/pull/64
More from XML::Sig
9.1
CVE-2026-9487
XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID
9.1
CVE-2026-9390
XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup
7.5
CVE-2026-18568
XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check