CVE-2025-40934
BaseFortify
Publication date: 2025-11-26
Last updated on: 2025-12-30
Assigner: CPANSec
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| xml\ | \ | sig_project |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-347 | The product does not verify, or incorrectly verifies, the cryptographic signature for data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in XML-Sig Perl module versions 0.27 through 0.67, where the module incorrectly validates XML files if the signatures are omitted. Specifically, an attacker can remove the signature from an XML document, and the module will still incorrectly indicate that the signature verification passed, even though the XML file is unsigned.
How can this vulnerability impact me? :
This vulnerability can allow an attacker to bypass signature verification on XML files, potentially leading to acceptance of unsigned or tampered XML data as valid. This could result in unauthorized data manipulation, security breaches, or trust violations in systems relying on XML signature validation for integrity and authenticity.