CVE-2026-40478
CriticalCVSS 9.0Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
Thymeleaf versions up to 3.1.3.RELEASE contain a security bypass vulnerability in the expression execution mechanism. Although the library provides protections against expression injection, it fails to properly neutralize specific syntax patterns, allowing unauthorized expression execution. An unauthenticated remote attacker can exploit this to achieve Server-Side Template Injection (SSTI) if the application passes unvalidated user input directly to the template engine.
Risk Assessment
The risk for the organization includes potential remote code execution on the server, which could lead to server compromise, data theft, or further attacks on the infrastructure. This vulnerability is particularly dangerous in web applications that process user input without proper validation.
Recommendation
Immediately update the Thymeleaf library to version 3.1.4.RELEASE or later. Additionally, always validate and sanitize user input before passing it to the template engine.
Original NVD description (English source)
Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the the expression execution mechanisms. Although the library provides mechanisms to prevent expression injection, it fails to properly neutralize specific syntax patterns that allow for the execution of unauthorized expressions. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library's protections to achieve Server-Side Template Injection (SSTI). This issue has ben fixed in version 3.1.4.RELEASE.