Junglewise Threat Intelligence

CVE-2026-40478: Thymeleaf expression execution bypass leading to SSTI

CVE-2026-40478 · Severity: critical · CVSS 9 · Published 2026-04-17

Technologies: Thymeleaf-Spring5, org.thymeleaf:thymeleaf (Maven), org.thymeleaf:thymeleaf-spring5 (Maven), Thymeleaf-Spring6, org.thymeleaf:thymeleaf-spring6 (Maven), Thymeleaf. Vendors: Thymeleaf, Red Hat, Maven.

Executive brief

Thymeleaf is a popular Java-based tool used by developers to generate web pages and emails. A security flaw has been identified where the library fails to properly block certain malicious commands hidden in user-provided data. If an application is configured to process unvalidated user input through this engine, an attacker could take control of the server, potentially leading to data theft or full system compromise.

Technical details

A Server-Side Template Injection (SSTI) vulnerability exists in Thymeleaf versions up to and including 3.1.3.RELEASE due to improper neutralization of specific syntax patterns in the expression execution mechanisms (CWE-917, CWE-1336). While the library includes protections against expression injection, certain syntax patterns can bypass these filters. An unauthenticated remote attacker can achieve arbitrary code execution on the server if the application developer passes unvalidated user input directly to the template engine. The vulnerability is patched in version 3.1.4.RELEASE. The attack complexity is rated as High, likely due to the specific syntax requirements needed to bypass existing protections.

Affected products

  • Thymeleaf Thymeleaf <= 3.1.3.RELEASE
  • Thymeleaf thymeleaf-spring5 <= 3.1.3.RELEASE
  • Thymeleaf thymeleaf-spring6 <= 3.1.3.RELEASE
  • Red Hat Red Hat OpenShift Dev Spaces 3.28 affected
  • Red Hat Red Hat Fuse 7 affected
  • Red Hat Red Hat Single Sign-On 7 affected

Timeline

  • 2026-04-15: advisory: Original GitHub security advisory published
  • 2026-04-17: disclosed: CVE published to NVD
  • 2026-04-17: patched: Fix released in version 3.1.4.RELEASE
  • 2026-05-28: advisory: Red Hat issued security advisory RHSA-2026:21772 for OpenShift Dev Spaces

References

Related threats