Server-Side Template Injection in Thymeleaf Affects Multiple Versions

CVE-2026-40477

What is CVE-2026-40477?

Thymeleaf, a widely used server-side Java template engine, exhibits a security bypass vulnerability that affects versions up to 3.1.3.RELEASE. This flaw occurs within the expression execution mechanisms, where the engine's protections against expression injection may be circumvented. As a result, if developers utilize unvalidated user input with the template engine, an unauthenticated attacker could exploit this weakness, leading to server-side template injection (SSTI). The issue has been addressed in version 3.1.4.RELEASE, which restricts access to sensitive objects, thereby enhancing security for applications that utilize Thymeleaf.

References