by Kastro
Paper/Archive/CVE-2026-40477

CVE-2026-40477

thymeleaf thymeleaf — Improper restriction of the scope of accessible objects in Thymeleaf expressions

EPSS 0.9%CVSS 9.1
critical.is priorityof 100
39
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 58.2.582 × 2011.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the expression execution mechanisms. Although the library provides mechanisms to prevent expression injection, it fails to properly restrict the scope of accessible objects, allowing specific potentially sensitive objects to be reached from within a template. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library's protections to achieve Server-Side Template Injection (SSTI). This issue has ben fixed in version 3.1.4.RELEASE.

Affected

ProductAffectedFixed inSource
thymeleaf< 3.1.4.RELEASE–CNA
org.thymeleaf:thymeleaf-spring5< 3.1.4.RELEASE–CNA
org.thymeleaf:thymeleaf-spring6< 3.1.4.RELEASE–CNA
Red Hat OpenShift Dev Spaces 3.28see advisory1779528224redhat-SADP
Red Hat OpenShift Dev Spaces 3.28see advisory1779359423redhat-SADP
Red Hat build of Apache Camel for Spring Boot 4see advisory–redhat-SADP
Red Hat build of Apache Camel for Spring Boot 4see advisory–redhat-SADP
Red Hat Fuse 7see advisory–redhat-SADP
Red Hat JBoss Enterprise Application Platform 7see advisory–redhat-SADP
Red Hat JBoss Enterprise Application Platform 7see advisory–redhat-SADP
Red Hat JBoss Enterprise Application Platform 7see advisory–redhat-SADP
Red Hat JBoss Enterprise Application Platform 8see advisory–redhat-SADP

Scores by source

GitHub_M (CNA)9.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
redhat-SADP (CNA)8.5CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/thymeleaf/thymeleaf/security/advisories/GHSA-r4v4-5mwr-2fwrrefaccess.redhat.com/security/cve/CVE-2026-40477refbugzilla.redhat.com/show_bug.cgi?id=2459344refsecurity.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40477.jsonadvisoryaccess.redhat.com/errata/RHSA-2026:21772