CVE-2026-40478
Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the the expression execution mechanisms. Although the library provides mechanisms to prevent expression injection, it fails to properly neutralize specific syntax patterns that allow for the execution of unauthorized expressions. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library's protections to achieve Server-Side Template Injection (SSTI). This issue has ben fixed in version 3.1.4.RELEASE.
Published:Apr 17, 2026
Last Modified:Apr 24, 2026
EPS:Apr 17, 2026
EPSS Score:0.00051
CVSS Score:9.1
Affected Products
Vendor
Product
Action
Vendor
Thymeleaf
Product
Org.thymeleaf:thymeleaf-spring5
Thymeleaf
Org.thymeleaf:thymeleaf-spring5
Vendor
Thymeleaf
Product
Org.thymeleaf:thymeleaf-spring6
Thymeleaf
Org.thymeleaf:thymeleaf-spring6
Vendor
Thymeleaf
Product
Thymeleaf
Thymeleaf
Thymeleaf
Exploits
No exploit reference
Common Weakness Enumeration
Common Attack Pattern Enumeration and Classification (CAPEC)
No CAPEC recorded yet
References
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
