CVE-2026-41901
Description
Thymeleaf is a server-side Java template engine for web and standalone environments. Prior to 3.1.5.RELEASE, a security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf. Although the library provides mechanisms to avoid the execution of potentially dangerous expressions in some specific sandboxed (restricted) contexts, it fails to properly neutralize specific constructs that allow this kind of expressions to be executed. If an application developer passes to the template engine unsanitized variables that contain such expressions, and these values are used in sandboxed contexts inside the templates, these expressions can be executed achieving Server-Side Template Injection (SSTI). This vulnerability is fixed in 3.1.5.RELEASE.
How to fix
- org.thymeleaf:thymeleaf3.1.5.RELEASE or later
- org.thymeleaf:thymeleaf-spring53.1.5.RELEASE or later
- org.thymeleaf:thymeleaf-spring63.1.5.RELEASE or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.thymeleaf:thymeleafMaven | v < 3.1.5.RELEASE | 3.1.5.RELEASE |
| org.thymeleaf:thymeleaf-spring5Maven | v < 3.1.5.RELEASE | 3.1.5.RELEASE |
| org.thymeleaf:thymeleaf-spring6Maven | v < 3.1.5.RELEASE | 3.1.5.RELEASE |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.