CVE-2026-40477
CriticalCVSS 9.0Exploitation Probability (EPSS)
Elevated risk55th percentile - higher than 55% of all known CVEs
Summary
Thymeleaf versions up to 3.1.3.RELEASE contain a security bypass vulnerability in the expression execution mechanisms. Although the library provides protection against expression injection, it fails to properly restrict the scope of accessible objects, allowing sensitive objects to be reached from within a template.
Risk Assessment
If an application passes unvalidated user input to the template engine, an unauthenticated remote attacker can bypass protections to achieve Server-Side Template Injection (SSTI), potentially leading to data leakage or server compromise.
Recommendation
Immediately update Thymeleaf to version 3.1.4.RELEASE or later. Additionally, always validate and sanitize user input before passing it to the template engine.
Original NVD description (English source)
Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the expression execution mechanisms. Although the library provides mechanisms to prevent expression injection, it fails to properly restrict the scope of accessible objects, allowing specific potentially sensitive objects to be reached from within a template. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library's protections to achieve Server-Side Template Injection (SSTI). This issue has ben fixed in version 3.1.4.RELEASE.