CVE-2026-40477

Name of the Vulnerable Software and Affected Versions Thymeleaf versions prior to 3.1.4.RELEASE

Description A security bypass exists in the expression execution mechanisms. The library fails to properly restrict the scope of accessible objects, which allows specific sensitive objects to be reached from within a template. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can achieve Server-Side Template Injection (SSTI), a technique where an attacker injects malicious code into a template to be executed on the server.

Recommendations Update to version 3.1.4.RELEASE. Ensure applications do not pass unvalidated user input directly to the template engine.