Cyber Posture

CVE-2026-40477

Critical

Published: 17 April 2026

Published
17 April 2026
Modified
24 April 2026
KEV Added
—
Patch
—
CVSS Score 9.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0005 15.7th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may create or modify references in user document templates to conceal malicious code or force authentication attempts.

Security Summary

CVE-2026-40477 is a security bypass vulnerability in the expression execution mechanisms of Thymeleaf, a server-side Java template engine used in web and standalone environments. It affects versions 3.1.3.RELEASE and prior. Although Thymeleaf provides mechanisms to prevent expression injection, it fails to properly restrict the scope of accessible objects, allowing potentially sensitive objects to be reached from within a template. Published on 2026-04-17, the vulnerability carries a CVSS v3.1 base score of 9.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) and maps to CWE-917 (Expression/Command Injection with Improper Escaping) and CWE-1336 (Improper Neutralization of Special Elements).

An unauthenticated remote attacker can exploit this vulnerability if an application developer passes unvalidated user input directly to the Thymeleaf template engine. By injecting crafted expressions, the attacker bypasses the library's protections to achieve Server-Side Template Injection (SSTI), potentially leading to high-impact confidentiality, integrity, and availability compromises across a changed scope.

The vulnerability has been fixed in Thymeleaf version 3.1.4.RELEASE. Additional details are available in the GitHub security advisory at https://github.com/thymeleaf/thymeleaf/security/advisories/GHSA-r4v4-5mwr-2fwr.

Details

CWE(s)
CWE-917CWE-1336

Affected Products

thymeleaf
thymeleaf
≤ 3.1.4

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1221 Template Injection Stealth
Adversaries may create or modify references in user document templates to conceal malicious code or force authentication attempts.
attack.mitre.org →
Why these techniques?

CVE enables Server-Side Template Injection (SSTI) in a public-facing web application component (Thymeleaf), directly mapping to T1221 (Template Injection) and T1190 (Exploit Public-Facing Application).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References