CVE-2025-40934: xml::sig from 0.27 (inclusive), through 0.67 (inclusive); +1 more affected products

Affected technology

xml::sig · from 0.27 (inclusive), through 0.67 (inclusive)
xml::sig project

XML::Sig · 0.27 to before 0.68
TIMLEGGE

Description’s affected range: versions 0.27 through 0.67 for Perl incorrectly validates XML files if signatures are omitted

Component: Not specified by the source
Function: verify()
File: lib/XML/Sig.pm

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An attacker can remove the signature from the XML document to make it pass the verification check. Source advisory’s CVSS 3.1 assessment (base score 9.3/10) rates confidentiality impact as low; integrity impact as high; availability impact as none.