CVE-2026-40477

Critical · CVSS 9.0

Thymeleaf — Server-Side Template Injection (SSTI) via expression execution security bypass

CVSS: 9.0; nvd
EPSS: 0.85%; 55th pct
KEV: No
Class: oss containerizable; CWE-917, CWE-1336, CWE-917

Description

Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the expression execution mechanisms. Although the library provides mechanisms to prevent expression injection, it fails to properly restrict the scope of accessible objects, allowing specific potentially sensitive objects to be reached from within a template. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library's protections to achieve Server-Side Template Injection (SSTI). This issue has ben fixed in version 3.1.4.RELEASE.

Search profile — drives PoC discovery

Symbols IExpressionContextIStandardExpressionStandardExpressionParserOGNLVariableExpressionEvaluatorSpringELTemplateEngineTemplateEngineContextIEngineConfigurationExpressionUtilsSpringStandardExpressionUtilsth:textth:field__${IProcessableElementTag

Keywords CVE-2026-40477Thymeleaf SSTIThymeleaf expression injection bypassThymeleaf security bypassThymeleaf template injectionGHSA-r4v4-5mwr-2fwrThymeleaf 3.1.3.RELEASE vulnerabilityThymeleaf sandbox bypassCWE-917 ThymeleafCWE-1336 ThymeleafThymeleaf restricted scope bypassThymeleaf unvalidated user input RCE

Versions: <= 3.1.3.RELEASE

Affected packages

Maven	org.thymeleaf:thymeleaf	0 → 3.1.4.RELEASE
Maven	org.thymeleaf:thymeleaf-spring5	0 → 3.1.4.RELEASE
Maven	org.thymeleaf:thymeleaf-spring6	0 → 3.1.4.RELEASE

References

Status: enriched · ingested 2026-06-30T06:00:22.000Z · profiled 2026-07-01T06:30:14.000Z