Loading...
Skip to main content
GeekWala

CVE-2026-40477 — Vulnerability in org.thymeleaf:thymeleaf-spring6...

CRITICAL

Improper restriction of the scope of accessible objects in Thymeleaf expressions

Published April 15, 2026Updated May 5, 2026Source: osv

Summary

### Impact A security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf up to and including 3.1.3.RELEASE. Although the library provides mechanisms to prevent expression injection, it fails to properly restrict the scope of accessible objects, allowing specific potentially sensitive objects to be reached from within a template. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library's protections to achieve Server-Side Template Injection (SSTI). ### Patches This has been fixed in Thymeleaf 3.1.4.RELEASE. ### Workarounds No workaround is available beyond ensuring applications do not pass unvalidated user input directly to the template engine. Upgrading to 3.1.4.RELEASE is strongly recommended in any case. ### Credits Thanks to Thomas Reburn (Praetorian) for responsible disclosure.

Advisory Timeline

  • First published April 15, 2026 (180 days ago).
  • Last revised May 5, 2026 — 20 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Maven
Update org.thymeleaf:thymeleaf-spring6 to 3.1.4.RELEASE or later
<!-- Update pom.xml dependency version to 3.1.4.RELEASE for org.thymeleaf:thymeleaf-spring6 -->
Maven
Update org.thymeleaf:thymeleaf to 3.1.4.RELEASE or later
<!-- Update pom.xml dependency version to 3.1.4.RELEASE for org.thymeleaf:thymeleaf -->
Maven
Update org.thymeleaf:thymeleaf-spring5 to 3.1.4.RELEASE or later
<!-- Update pom.xml dependency version to 3.1.4.RELEASE for org.thymeleaf:thymeleaf-spring5 -->

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (3)

Affects 1 ecosystem: maven (3).

PackageEcosystemAffectedFixed In
org.thymeleaf:thymeleaf-spring6
maven
3.1.0.M1, 3.1.0.M2, 3.1.0.M3, 3.1.0.RC1 (+5 more)3.1.4.RELEASE
org.thymeleaf:thymeleaf
maven
1.0.0, 1.0.0-beta1, 1.0.0-beta2, 1.0.0-beta3 (+77 more)3.1.4.RELEASE
org.thymeleaf:thymeleaf-spring5
maven
3.0.10.RELEASE, 3.0.11.RELEASE, 3.0.12.RELEASE, 3.0.13.RELEASE (+18 more)3.1.4.RELEASE

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.0 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2026-40477?
Improper restriction of the scope of accessible objects in Thymeleaf expressions This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.0/10).
How do I check if my project is affected by CVE-2026-40477?
CVE-2026-40477 affects org.thymeleaf:thymeleaf-spring6, org.thymeleaf:thymeleaf and org.thymeleaf:thymeleaf-spring5. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-40477 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
9.0

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-r4v4-5mwr-2fwr

Related CVEs

  • CVE-2026-107726
    CRITICAL

    Hazelcast allows arbitrary member memory access by low-privileged client

  • CVE-2026-41901
    CRITICAL

    Sandboxed Thymeleaf expressions vulnerable to improper recognition of unauthorized syntax patterns

  • CVE-2026-107282
    CRITICAL

    AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host

  • CVE-2026-40478
    CRITICAL

    Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf

More Maven advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies