Executive brief
Thymeleaf is a popular Java-based tool used by web applications to generate dynamic content. A security flaw in how it handles user-provided data allows attackers to bypass built-in safety restrictions and execute unauthorized commands on the server. This could lead to a complete system takeover, theft of sensitive data, or disruption of services.
Technical details
A Server-Side Template Injection (SSTI) vulnerability exists in Thymeleaf's expression execution engine due to improper neutralization of specific syntax patterns. While Thymeleaf implements a sandbox to restrict dangerous expressions, certain constructs can bypass these protections if unsanitized user input is passed into sandboxed template contexts. An attacker can exploit this by submitting specially crafted expressions that the engine fails to recognize as unauthorized, leading to arbitrary code execution on the host. The vulnerability is present in versions up to 3.1.4.RELEASE and is fixed in 3.1.5.RELEASE. Exploitation requires the application to pass unvalidated variables into a template context where they are subsequently evaluated.
Affected products
- Thymeleaf Thymeleaf <= 3.1.4.RELEASE
- Thymeleaf thymeleaf-spring5 <= 3.1.4.RELEASE
- Thymeleaf thymeleaf-spring6 <= 3.1.4.RELEASE
Timeline
- 2026-04-29: advisory: GitHub Security Advisory published by maintainers
- 2026-05-12: disclosed: CVE published to NVD
- 2026-05-12: patched: Fixed in version 3.1.5.RELEASE