XML::Sig modules prior to version 0.71 construct XPath expressions by concatenating the SignedInfo/Reference/@URI value from an XML document. The URI is neither escaped nor validated against the NCName grammar required for XML IDs. An attacker can inject a single quote into the URI to terminate the string literal in the generated XPath and append arbitrary XPath operators. This XPath injection allows manipulation of the element that is selected for digest calculation, meaning the signature verification process can be directed to any element in the document rather than the intended one, effectively bypassing signature validation.

The vulnerability affects the TIMLEGGE XML::Sig Perl module in all releases preceding 0.71. Upgrading to version 0.71 or later removes the flaw by sanitizing URI input before building the XPath expression.

The CVSS score of 9.1 and the EPSS value is unavailable, but the absence of a KEV listing does not diminish the potential impact. If an application accepts external XML documents that it verifies with XML::Sig, a crafted document containing an injected URI can allow the attacker to target arbitrary nodes for examination. This can lead to acceptance of forged signatures and subsequent data integrity or authenticity compromise. The likely attack vector is remote, via any channel that delivers XML to the vulnerable application, or local, if the application processes user-supplied XML. Given the potential for bypass, the overall risk can be considered moderate to high for systems that rely on XML::Sig for secure signature validation.