CVE-2026-18568: TIMLEGGE XML::Sig · Improper Verification of Cryptographic Signature
Affects TIMLEGGE XML::SigSource CVE Database V5
Not known to be exploited · CVSS 7.5 High : upgrade to 0.72 soon.
Data as of 1 Nov 2026, 22:58 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 24% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 0.72
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NExploitation evidence
Disclosed: evidence found.
CVE published 3 Aug 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 1 Nov 2026.
What to do
Upgrade XML::Sig and XML-Sig to 0.72.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| TIMLEGGEXML::Sig | Affected
| Fixed in
|
GitHubXML-Sigpkg:github/XML-SigOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
If you cannot patch yet, users should avoid using affected versions (0.29 up to but not including 0.72) of XML::Sig for signature verification on untrusted XML data. Downgrading to version 0.28 or earlier, which uses a different verification method not affected by this issue, may be considered as a temporary mitigation. Monitor vendor communications for official patches or updates.
Description
XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check. verify in lib/XML/Sig.pm counts the `//dsig:Signature` elements into `$numsigs` and iterates over them, but two paths reach `next` before any digest or key check runs: a `SignedInfo/Reference/@URI` that resolves to no element while `$numsigs` is greater than 1, and, when `id_attr` is set, a reference that does not match the requested ID. The loop records nothing about what it checked, so when every signature takes one of those paths control reaches the unconditional `return 1` that ends verify. Two `Signature` elements whose Reference URI names an ID that no element carries is enough, as is one such element combined with `id_attr`. Any caller that passes untrusted XML to verify can receive a true return for a document in which no digest and no signature value was checked; a `cert` or `cert_text` trust anchor does not change this, because no key check runs. Versions up to 0.28 use an XML::XPath based verify that has no such skip and are not affected.