Server-Side Template Injection in Thymeleaf by Thymeleaf
CVE-2026-40478

9.1CRITICAL

Key Information:

Vendor

Thymeleaf

Status
Thymeleaf
Org.thymeleaf:thymeleaf-spring5
Org.thymeleaf:thymeleaf-spring6
Vendor
CVE Published:
17 April 2026

What is CVE-2026-40478?

Thymeleaf is a widely used server-side Java template engine that allows developers to create dynamic web pages. However, earlier versions, specifically 3.1.3.RELEASE and prior, contain a critical vulnerability that could allow unauthorized expression execution. This flaw resides in the expression execution mechanisms, where despite built-in protections against expression injection, certain syntax patterns can be exploited. If unvalidated user input is directly fed into the template engine, an attacker may perform Server-Side Template Injection (SSTI), enabling them to execute arbitrary code within the server environment. This issue has been addressed in version 3.1.4.RELEASE.

Affected Version(s)

org.thymeleaf:thymeleaf-spring5 < 3.1.4.RELEASE

org.thymeleaf:thymeleaf-spring6 < 3.1.4.RELEASE

thymeleaf < 3.1.4.RELEASE

References

https://github.com/thymeleaf/thymeleaf/security/advisorie...
x_refsource_CONFIRM

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.