CVE-2026-40478: Thymeleaf expression execution bypass leading to SSTI

CVE-2026-40478 · Severity: critical · CVSS 9 · Published 2026-04-17

Thymeleaf is a popular Java-based tool used by developers to generate web pages and emails. A security flaw has been identified where the library fails to properly block certain malicious commands hidden in user-provided data. If an application is configured to process unvalidated user input through this engine, an attacker could take control of the server, potentially leading to data theft or full system compromise.

Technologies: org.thymeleaf:thymeleaf (Maven), org.thymeleaf:thymeleaf-spring5 (Maven), org.thymeleaf:thymeleaf-spring6 (Maven), Thymeleaf, Thymeleaf-Spring5, Thymeleaf-Spring6. Vendors: Maven, Thymeleaf.

Quick answers

Is CVE-2026-40478 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-40478 being exploited in the wild.
How severe is CVE-2026-40478?
Critical severity, with a CVSS score of 9, published 17 April 2026.
Which products and versions are affected?
org.thymeleaf:thymeleaf (Maven) <= 3.1.3.RELEASE, ECOSYSTEM:introduced=0,fixed=3.1.4.RELEASE; org.thymeleaf:thymeleaf-spring5 (Maven) <= 3.1.3.RELEASE, ECOSYSTEM:introduced=0,fixed=3.1.4.RELEASE; org.thymeleaf:thymeleaf-spring6 (Maven) <= 3.1.3.RELEASE, ECOSYSTEM:introduced=0,fixed=3.1.4.RELEASE; Thymeleaf <= 3.1.3.RELEASE; and 2 more.
Is there a fix for CVE-2026-40478?
Yes. org.thymeleaf:thymeleaf (Maven): upgrade to 3.1.4.RELEASE or later; org.thymeleaf:thymeleaf-spring5 (Maven): upgrade to 3.1.4.RELEASE or later; org.thymeleaf:thymeleaf-spring6 (Maven): upgrade to 3.1.4.RELEASE or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40478 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-40478?
Check whether you run org.thymeleaf:thymeleaf (Maven), org.thymeleaf:thymeleaf-spring5 (Maven), org.thymeleaf:thymeleaf-spring6 (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.thymeleaf:thymeleaf (Maven): upgrade to 3.1.4.RELEASE or later
    # set org.thymeleaf:thymeleaf to 3.1.4.RELEASE in your pom.xml or build.gradle
  • org.thymeleaf:thymeleaf-spring5 (Maven): upgrade to 3.1.4.RELEASE or later
    # set org.thymeleaf:thymeleaf-spring5 to 3.1.4.RELEASE in your pom.xml or build.gradle
  • org.thymeleaf:thymeleaf-spring6 (Maven): upgrade to 3.1.4.RELEASE or later
    # set org.thymeleaf:thymeleaf-spring6 to 3.1.4.RELEASE in your pom.xml or build.gradle

Technical details

A Server-Side Template Injection (SSTI) vulnerability exists in Thymeleaf versions up to and including 3.1.3.RELEASE due to improper neutralization of specific syntax patterns in the expression execution mechanisms (CWE-917, CWE-1336). While the library includes protections against expression injection, certain syntax patterns can bypass these filters. An unauthenticated remote attacker can achieve arbitrary code execution on the server if the application developer passes unvalidated user input directly to the template engine. The vulnerability is patched in version 3.1.4.RELEASE. The attack complexity is rated as High, likely due to the specific syntax requirements needed to bypass existing protections.

Affected products

  • Thymeleaf Thymeleaf <= 3.1.3.RELEASE
  • Thymeleaf thymeleaf-spring5 <= 3.1.3.RELEASE
  • Thymeleaf thymeleaf-spring6 <= 3.1.3.RELEASE
  • Red Hat Red Hat OpenShift Dev Spaces 3.28 affected
  • Red Hat Red Hat Fuse 7 affected
  • Red Hat Red Hat Single Sign-On 7 affected

Identifiers

  • CVE-2026-40478
  • GHSA-xjw8-8c5c-9r79

Timeline

  • 2026-04-15: advisory: Original GitHub security advisory published
  • 2026-04-17: disclosed: CVE published to NVD
  • 2026-04-17: patched: Fix released in version 3.1.4.RELEASE
  • 2026-05-28: advisory: Red Hat issued security advisory RHSA-2026:21772 for OpenShift Dev Spaces

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.