9.1
Critical
CVE-2026-40478 Thymeleaf is a server-side Java template engine for web and standalone environments
Description
Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the the expression execution mechanisms. Although the library provides mechanisms to prevent expression injection, it fails to properly neutralize specific syntax patterns that allow for the execution of unauthorized expressions. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library's protections to achieve Server-Side Template Injection (SSTI). This issue has ben fixed in version 3.1.4.RELEASE.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| thymeleaf 3.1 | earliest → < 3.1.4.RELEASE | 3.1.4.RELEASE |
| org.thymeleaf:thymeleaf-spring5 3.1 | earliest → < 3.1.4.RELEASE | 3.1.4.RELEASE |
| org.thymeleaf:thymeleaf-spring6 3.1 | earliest → < 3.1.4.RELEASE | 3.1.4.RELEASE |
| Red Hat OpenShift Dev Spaces 3.28 1779359423 | earliest → < 1779359423 | 1779359423 |
| Red Hat Fuse 7 | Versions not published | |
| Red Hat Single Sign-On 7 | Versions not published | |
| Red Hat build of Apache Camel for Spring Boot 4 | Versions not published | |
| Red Hat JBoss Enterprise Application Platform 7 | Versions not published | |
| Red Hat JBoss Enterprise Application Platform 8 | Versions not published |
Show the other branch Hide the other branch
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Versions not published |
References
- github.com github.com
Timeline
- Published
- Last modified