CVE-2026-40478

CRITICAL

Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf

Title source: cna
STIX 2.1

Description

Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the the expression execution mechanisms. Although the library provides mechanisms to prevent expression injection, it fails to properly neutralize specific syntax patterns that allow for the execution of unauthorized expressions. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library's protections to achieve Server-Side Template Injection (SSTI). This issue has ben fixed in version 3.1.4.RELEASE.

References (1)

Core 1
Core References

Scores

CVSS v3 9.0
EPSS 0.0058
EPSS Percentile 43.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-1336 CWE-917
Status published
Products (6)
org.thymeleaf/thymeleaf 0 - 3.1.4.RELEASEMaven
org.thymeleaf/thymeleaf-spring5 0 - 3.1.4.RELEASEMaven
org.thymeleaf/thymeleaf-spring6 0 - 3.1.4.RELEASEMaven
thymeleaf/org.thymeleaf:thymeleaf-spring5 < 3.1.4.RELEASE
thymeleaf/org.thymeleaf:thymeleaf-spring6 < 3.1.4.RELEASE
thymeleaf/thymeleaf < 3.1.4.RELEASE
Published Apr 17, 2026
Tracked Since Apr 18, 2026