CVE-2026-40478

Name of the Vulnerable Software and Affected Versions Thymeleaf versions prior to 3.1.4.RELEASE

Description A security bypass exists in the expression execution mechanisms of Thymeleaf, a server-side Java template engine. The library fails to properly neutralize specific syntax patterns, allowing an unauthenticated remote attacker to bypass security protections and execute unauthorized expressions if unvalidated user input is passed directly to the template engine. This leads to Server-Side Template Injection (SSTI), a technique where an attacker injects malicious templates that are executed on the server, potentially resulting in arbitrary code execution or data exposure.

Recommendations Update to version 3.1.4.RELEASE. Ensure applications do not pass unvalidated user input directly to the template engine.