Log in Start free

Vulnerability · Published Apr 17, 2026 · Assigned by GitHub_M

CVE-2026-40477Improper restriction of the scope of accessible objects in Thymeleaf expressions

Critical 9.1

In plain English

A critical-severity expression language injection in org.thymeleaf:thymeleaf-spring5 from thymeleaf. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 58% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)0.9%top 41.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the expression execution mechanisms. Although the library provides mechanisms to prevent expression injection, it fails to properly restrict the scope of accessible objects, allowing specific potentially sensitive objects to be reached from within a template. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library's protections to achieve Server-Side Template Injection (SSTI). This issue has ben fixed in version 3.1.4.RELEASE.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.thymeleaf:thymeleaf3.1.4.RELEASEGHSA-r4v4-5mwr-2fwr
Mavenorg.thymeleaf:thymeleaf-spring53.1.4.RELEASEGHSA-r4v4-5mwr-2fwr
Mavenorg.thymeleaf:thymeleaf-spring63.1.4.RELEASEGHSA-r4v4-5mwr-2fwr

Affected products (as reported)

VendorProductVersions
thymeleaf thymeleaf < 3.1.4.RELEASE
thymeleaf org.thymeleaf:thymeleaf-spring5 < 3.1.4.RELEASE
thymeleaf org.thymeleaf:thymeleaf-spring6 < 3.1.4.RELEASE

Weakness: CWE-917, CWE-1336 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

References