CVE-2026-40477 Improper restriction of the scope of accessible objects in Thymeleaf expressions
An unauthenticated remote attacker can achieve Server-Side Template Injection and execute arbitrary code if unvalidated user input is passed to the Thymeleaf template engine.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-40477?
CVE-2026-40477 is a critical code injection vulnerability in org.thymeleaf:thymeleaf-spring5, published on 17 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the expression execution mechanisms. Although the library provides mechanisms to prevent expression injection, it fails to properly restrict the scope of accessible objects, allowing specific potentially sensitive objects to be reached from within a template. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library's protections to achieve Server-Side Template Injection (SSTI). This issue has ben fixed in version 3.1.4.RELEASE.
Which versions are affected by CVE-2026-40477?
6 open source packages ship an affected version, including org.thymeleaf:thymeleaf-spring5, org.thymeleaf:thymeleaf and org.thymeleaf:thymeleaf-spring6. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.thymeleaf:thymeleaf-spring5 Maven | All versions | 3.1.4.RELEASE |
org.thymeleaf:thymeleaf-spring5 Maven | All versions | 3.1.4.RELEASE |
org.thymeleaf:thymeleaf Maven | All versions | 3.1.4.RELEASE |
org.thymeleaf:thymeleaf Maven | All versions | 3.1.4.RELEASE |
org.thymeleaf:thymeleaf-spring6 Maven | All versions | 3.1.4.RELEASE |
org.thymeleaf:thymeleaf-spring6 Maven | All versions | 3.1.4.RELEASE |
Products include Thymeleaf Thymeleaf.
How do I fix CVE-2026-40477?
Upgrade org.thymeleaf:thymeleaf-spring5 to 3.1.4.RELEASE or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-40477 being exploited?
There is no known exploitation of CVE-2026-40477 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in org.thymeleaf:thymeleaf-spring5
Sources
Also known as GHSA-r4v4-5mwr-2fwr.