CVE-2023-38286 Spring-boot-admin sandbox bypass via crafted HTML
Attackers can bypass the Thymeleaf sandbox via crafted HTML, potentially leading to code execution in Spring Boot Admin when specific features are enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-38286?
CVE-2023-38286 is a high-severity code injection vulnerability in n/a, published on 14 Jul 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Thymeleaf through 3.1.1.RELEASE, as used in spring-boot-admin (aka Spring Boot Admin) through 3.1.1 and other products, allows sandbox bypass via crafted HTML. This may be relevant for SSTI (Server Side Template Injection) and code execution in spring-boot-admin if MailNotifier is enabled and there is write access to environment variables via the UI.
Weakness: CWE-77
Which versions are affected by CVE-2023-38286?
4 open source packages ship an affected version, including de.codecentric:spring-boot-admin-server. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
de.codecentric:spring-boot-admin-server Maven | All versions | 2.7.16 |
de.codecentric:spring-boot-admin-server Maven | All versions | 2.7.16 |
de.codecentric:spring-boot-admin-server Maven | From 3.0.0 | 3.1.2 |
de.codecentric:spring-boot-admin-server Maven | From 3.0.0 | 3.1.2 |
Products include Codecentric Spring Boot Admin, Thymeleaf Thymeleaf.
How do I fix CVE-2023-38286?
Upgrade de.codecentric:spring-boot-admin-server to a fixed version for your release line: 2.7.16 or 3.1.2.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2023-38286 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-38286 exists.
Other vulnerabilities in n/a
Sources
Also known as CLSA-2025-1752019357, CLSA-2025-1764029254, GHSA-7gj7-224w-vpr3, RHLW-2026-81384c14bc892e51.