Loading...
Skip to main content
GeekWala

CVE-2026-40478 — Vulnerability in org.thymeleaf:thymeleaf-spring6...

CRITICAL

Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf

Published April 15, 2026Updated May 5, 2026Source: osv

Summary

### Impact A security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf up to and including 3.1.3.RELEASE. Although the library provides mechanisms to prevent expression injection, it fails to properly neutralize specific syntax patterns that allow for the execution of unauthorized expressions. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library's protections to achieve Server-Side Template Injection (SSTI). ### Patches This has been fixed in Thymeleaf 3.1.4.RELEASE. ### Workarounds No workaround is available beyond ensuring applications do not pass unvalidated user input directly to the template engine. Upgrading to 3.1.4.RELEASE is strongly recommended in any case. ### Credits Thanks to Dawid Bakaj (VIPentest.com) for responsible disclosure.

Advisory Timeline

  • First published April 15, 2026 (180 days ago).
  • Last revised May 5, 2026 — 20 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Maven
Update org.thymeleaf:thymeleaf-spring6 to 3.1.4.RELEASE or later
<!-- Update pom.xml dependency version to 3.1.4.RELEASE for org.thymeleaf:thymeleaf-spring6 -->
Maven
Update org.thymeleaf:thymeleaf to 3.1.4.RELEASE or later
<!-- Update pom.xml dependency version to 3.1.4.RELEASE for org.thymeleaf:thymeleaf -->
Maven
Update org.thymeleaf:thymeleaf-spring5 to 3.1.4.RELEASE or later
<!-- Update pom.xml dependency version to 3.1.4.RELEASE for org.thymeleaf:thymeleaf-spring5 -->

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (3)

Affects 1 ecosystem: maven (3).

PackageEcosystemAffectedFixed In
org.thymeleaf:thymeleaf-spring6
maven
3.1.0.M1, 3.1.0.M2, 3.1.0.M3, 3.1.0.RC1 (+5 more)3.1.4.RELEASE
org.thymeleaf:thymeleaf
maven
1.0.0, 1.0.0-beta1, 1.0.0-beta2, 1.0.0-beta3 (+77 more)3.1.4.RELEASE
org.thymeleaf:thymeleaf-spring5
maven
3.0.10.RELEASE, 3.0.11.RELEASE, 3.0.12.RELEASE, 3.0.13.RELEASE (+18 more)3.1.4.RELEASE

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.0 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2026-40478?
Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.0/10).
How do I check if my project is affected by CVE-2026-40478?
CVE-2026-40478 affects org.thymeleaf:thymeleaf-spring6, org.thymeleaf:thymeleaf and org.thymeleaf:thymeleaf-spring5. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-40478 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
9.0

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-xjw8-8c5c-9r79

Related CVEs

More Maven advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies