by Kastro
Paper/Archive/CVE-2026-40478

CVE-2026-40478

thymeleaf thymeleaf — Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf

EPSS 1%CVSS 9.1
critical.is priorityof 100
40
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 65.7.657 × 2013.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the the expression execution mechanisms. Although the library provides mechanisms to prevent expression injection, it fails to properly neutralize specific syntax patterns that allow for the execution of unauthorized expressions. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library's protections to achieve Server-Side Template Injection (SSTI). This issue has ben fixed in version 3.1.4.RELEASE.

Affected

ProductAffectedFixed inSource
thymeleaf< 3.1.4.RELEASE–CNA
org.thymeleaf:thymeleaf-spring5< 3.1.4.RELEASE–CNA
org.thymeleaf:thymeleaf-spring6< 3.1.4.RELEASE–CNA
Red Hat OpenShift Dev Spaces 3.28see advisory1779528224redhat-SADP
Red Hat OpenShift Dev Spaces 3.28see advisory1779359423redhat-SADP
Red Hat build of Apache Camel for Spring Boot 4see advisory–redhat-SADP
Red Hat build of Apache Camel for Spring Boot 4see advisory–redhat-SADP
Red Hat Fuse 7see advisory–redhat-SADP
Red Hat JBoss Enterprise Application Platform 7see advisory–redhat-SADP
Red Hat JBoss Enterprise Application Platform 7see advisory–redhat-SADP
Red Hat JBoss Enterprise Application Platform 7see advisory–redhat-SADP
Red Hat JBoss Enterprise Application Platform 8see advisory–redhat-SADP

Scores by source

GitHub_M (CNA)9.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
redhat-SADP (CNA)8.5CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/thymeleaf/thymeleaf/security/advisories/GHSA-xjw8-8c5c-9r79refaccess.redhat.com/security/cve/CVE-2026-40478refbugzilla.redhat.com/show_bug.cgi?id=2459349refsecurity.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40478.jsonadvisoryaccess.redhat.com/errata/RHSA-2026:21772