Read the docs
TI-2025-27325 Aliases CVE-2025-40934GHSA-v825-mc9m-64qr

XML-Sig prior to 0.68 for Perl improperly validates XML without signatures

Priority MEDIUM 45CWE-347Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-347.

Summary

XML-Sig versions 0.27 through 0.67 for Perl incorrectly validates XML files if signatures are omitted. An attacker can remove the signature from the XML document to make it pass the verification check. XML-Sig is a Perl module to validate signatures on XML files.  An unsigned XML file should return an error message.  The affected versions return true when attempting to validate an XML file that contains no signatures.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00177 7th percentileScored 2026-11-07
Fix Fixed XML::Sig (TIMLEGGE): 0.68

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TIMLEGGEXML::Sig0.27 to before 0.680.68Patch availableCNA
  • XML::Sig VendorTIMLEGGE Affected 0.27 to before 0.68 Fixed in 0.68 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:xml\:\:sig_project:xml\:\:sig:*:*:*:*:*:perl:*:*sig_project xml\VulnerableXml
  • cpe:2.3:a:xml\:\:sig_project:xml\:\:sig:*:*:*:*:*:perl:*:* Versions sig_project xml\ Vulnerable ·Xml

Remediation

  • Fix · CNA XML::Sig (TIMLEGGE) Fixed in 0.68

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-40934
  2. 2026-10-03 Alias added: GHSA-v825-mc9m-64qr

References

Patch 2

  • TI-2026-23735 Integer overflow in TIMLEGGE Crypt::NaCl::Sodium CVSS 3.1CRITICAL 9.8
  • TI-2020-18981 IO::Compress::Brotli versions prior to 0.007 for Perl have an integer overflow in the bundled Brotli C library CVSS 3.1CRITICAL 9.8
  • TI-2026-14905 Improper signature verification in TIMLEGGE Net::SAML2 CVSS 3.1CRITICAL 9.8
  • TI-2026-08239 XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup CVSS 3.1CRITICAL 9.1
  • TI-2026-10497 Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to… CVSS 3.1CRITICAL 9.1
  • TI-2026-08334 Improper signature verification in TIMLEGGE XML::Sig CVSS 3.1CRITICAL 9.1
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences