CVE-2026-40477
Description
Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the expression execution mechanisms. Although the library provides mechanisms to prevent expression injection, it fails to properly restrict the scope of accessible objects, allowing specific potentially sensitive objects to be reached from within a template. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library's protections to achieve Server-Side Template Injection (SSTI). This issue has ben fixed in version 3.1.4.RELEASE.
How to fix
- thymeleaf thymeleaf3.1.4 or later
- org.thymeleaf:thymeleaf3.1.4.RELEASE or later
- org.thymeleaf:thymeleaf-spring53.1.4.RELEASE or later
- org.thymeleaf:thymeleaf-spring63.1.4.RELEASE or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| thymeleaf thymeleaf | v < 3.1.4 | 3.1.4 |
| org.thymeleaf:thymeleafMaven | v < 3.1.4.RELEASE | 3.1.4.RELEASE |
| org.thymeleaf:thymeleaf-spring5Maven | v < 3.1.4.RELEASE | 3.1.4.RELEASE |
| org.thymeleaf:thymeleaf-spring6Maven | v < 3.1.4.RELEASE | 3.1.4.RELEASE |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.