PT-2026-33215 · Thymeleaf · Thymeleaf

Osidb Bzimport · CVE-2026-40478 · Published 2026-04-15 · Updated 2026-06-30

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Thymeleaf versions prior to 3.1.4.RELEASE

Description A security bypass exists in the expression execution mechanisms. The library fails to properly neutralize specific syntax patterns, which allows for the execution of unauthorized expressions. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can achieve Server-Side Template Injection (SSTI), a flaw where an attacker injects malicious code into a template, potentially leading to code execution or data exposure.

Recommendations Update to version 3.1.4.RELEASE. Ensure applications do not pass unvalidated user input directly to the template engine.

Exploit

Fix

Weakness Enumeration

CWE-917

CWE-1336

Related Identifiers

BDU:2026-05835

CVE-2026-40478

GHSA-XJW8-8C5C-9R79

Affected Products

Thymeleaf

References · 23

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40478.json · Exploit
• https://github.com/thymeleaf/thymeleaf/security/advisories/GHSA-xjw8-8c5c-9r79 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:21772 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xjw8-8c5c-9r79 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05835 · Security Note
• https://osv.dev/vulnerability/CVE-2026-40478 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40478 · Security Note
• https://github.com/thymeleaf/thymeleaf · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2459349 · Note
• https://twitter.com/0dayPublishing/status/2046267670836777437 · Twitter Post
• https://twitter.com/BrianVerm/status/2049509669501079771 · Twitter Post
• https://twitter.com/ksg93rd/status/2049854499276157082 · Twitter Post
• https://twitter.com/pulsepatchio/status/2044621622540226795 · Twitter Post
• https://twitter.com/PTGLondon/status/2045942823233454448 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2045373238641877479 · Twitter Post