PT-2026-33214 · Thymeleaf · Thymeleaf

Published 2026-04-15 · Updated 2026-04-18 · CVE-2026-40477

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Thymeleaf versions prior to 3.1.4.RELEASE

Description A security bypass exists in the expression execution mechanisms. The library fails to properly restrict the scope of accessible objects, which allows specific sensitive objects to be reached from within a template. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can achieve Server-Side Template Injection (SSTI), a technique where an attacker injects malicious code into a template to be executed on the server.

Recommendations Update to version 3.1.4.RELEASE. Ensure applications do not pass unvalidated user input directly to the template engine.

Fix

Weakness Enumeration

CWE-917

CWE-1336

Related Identifiers

CVE-2026-40477

GHSA-R4V4-5MWR-2FWR

Affected Products

Thymeleaf

References · 8

• https://github.com/thymeleaf/thymeleaf/security/advisories/GHSA-r4v4-5mwr-2fwr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40477 · Security Note
• https://osv.dev/vulnerability/GHSA-r4v4-5mwr-2fwr · Vendor Advisory
• https://github.com/thymeleaf/thymeleaf · Note
• https://reddit.com/r/VulnMatter/comments/1sn0wwt/resumen_diario_de_vulnerabilidades_16042026 · Reddit Post
• https://twitter.com/VulmonFeeds/status/2045375798392041531 · Twitter Post
• https://twitter.com/pulsepatchio/status/2044621285351637030 · Twitter Post
• https://twitter.com/CVEnew/status/2045467374808113252 · Twitter Post