XML-Sig Perl Module Validation Flaw Allows Bypass for Unsigned XML Files

CVE-2025-40934

What is CVE-2025-40934?

The XML-Sig Perl module versions 0.27 through 0.67 exhibit a critical flaw in signature verification. This issue arises when XML documents lacking signatures are incorrectly validated, facilitating a situation where unsigned XML files bypass verification checks. Essentially, while validating an XML file, the module erroneously returns a success message even when no signature is present. This vulnerability allows attackers to exploit the module, thereby compromising the integrity of XML data handling and potentially enabling unauthorized data manipulation.

References