PT-2026-33215 · Thymeleaf · Thymeleaf

Published 2026-04-15 · Updated 2026-04-30 · CVE-2026-40478

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Thymeleaf versions prior to 3.1.4.RELEASE

Description A security bypass exists in the expression execution mechanisms. The library fails to properly neutralize specific syntax patterns, which allows for the execution of unauthorized expressions. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can achieve Server-Side Template Injection (SSTI), a flaw where an attacker injects malicious code into a template, potentially leading to code execution or data exposure.

Recommendations Update to version 3.1.4.RELEASE. Ensure applications do not pass unvalidated user input directly to the template engine.

Fix

Weakness Enumeration

CWE-1336

CWE-917

Related Identifiers

BDU:2026-05835

CVE-2026-40478

GHSA-XJW8-8C5C-9R79

Affected Products

Thymeleaf

References · 16

• https://github.com/thymeleaf/thymeleaf/security/advisories/GHSA-xjw8-8c5c-9r79 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05835 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-40478 · Security Note
• https://osv.dev/vulnerability/GHSA-xjw8-8c5c-9r79 · Vendor Advisory
• https://github.com/thymeleaf/thymeleaf · Note
• https://twitter.com/dailycve/status/2044577566623752391 · Twitter Post
• https://twitter.com/ksg93rd/status/2049854499276157082 · Twitter Post
• https://twitter.com/PTGLondon/status/2045942823233454448 · Twitter Post
• https://snyk.io/blog/thymeleaf-injection · Reddit Post
• https://twitter.com/0dayPublishing/status/2046267670836777437 · Twitter Post
• https://twitter.com/dailycve/status/2044580543426138483 · Twitter Post
• https://twitter.com/BrianVerm/status/2049509669501079771 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2045373238641877479 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1sn0wwt/resumen_diario_de_vulnerabilidades_16042026 · Reddit Post
• https://twitter.com/CVEnew/status/2045467373730238808 · Twitter Post