PT-2026-36947 · Thymeleaf · Thymeleaf

Published 2026-04-29 · Updated 2026-05-13 · CVE-2026-41901

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Thymeleaf versions prior to 3.1.5.RELEASE

Description A security bypass exists in the expression execution mechanisms of Thymeleaf. The library fails to properly neutralize specific constructs within sandboxed (restricted) contexts, allowing unsafe template expressions to execute. If an application developer passes unsanitized variables to the template engine and these values are used in sandboxed contexts, it can lead to Server-Side Template Injection (SSTI), where an attacker can execute arbitrary code on the server.

Recommendations Update to version 3.1.5.RELEASE. Ensure applications do not pass unvalidated or unsanitized data directly to the template engine.

Exploit

Fix

Weakness Enumeration

CWE-917

CWE-1336

Related Identifiers

BDU:2026-07527

CVE-2026-41901

GHSA-C9PH-GXWW-7744

Affected Products

Thymeleaf

References · 16

• 🔥 https://github.com/HORKimhab/CVE-2026-41901 · Exploit
• https://osv.dev/vulnerability/GHSA-c9ph-gxww-7744 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41901 · Security Note
• https://bdu.fstec.ru/vul/2026-07527 · Security Note
• https://github.com/thymeleaf/thymeleaf · Note
• https://github.com/thymeleaf/thymeleaf/security/advisories/GHSA-c9ph-gxww-7744 · Note
• https://t.me/CVEtracker/53572 · Telegram Post
• https://twitter.com/lyrie_ai/status/2053205277147594923 · Twitter Post
• https://twitter.com/the_yellow_fall/status/2052011498269253875 · Twitter Post
• https://twitter.com/UpwindMDR/status/2051424449715490933 · Twitter Post
• https://t.me/cveNotify/163311 · Telegram Post
• https://twitter.com/lyrie_ai/status/2053205274236686533 · Twitter Post
• https://twitter.com/lyrie_ai/status/2053205276170318076 · Twitter Post
• https://github.com/thymeleaf/thymeleaf/releases/tag/thymeleaf-3.1.5.RELEASE · Note
• https://twitter.com/CVEnew/status/2054340916484120862 · Twitter Post