CVE-2026-40477 - Vulnerability Analysis

Overview

Thymeleaf <= 3.1.3.RELEASE contains a server-side template injection caused by improper restriction of accessible objects in expression execution, letting unauthenticated remote attackers bypass protections, exploit requires unvalidated user input passed to templates.

Severity & Score

Impact

Unauthenticated remote attackers can execute arbitrary server-side template code, potentially leading to full server compromise.

Mitigation

Upgrade to version 3.1.4.RELEASE or later.

References

• https://github.com/thymeleaf/thymeleaf/security/advisories/GHSA-r4v4-5mwr-2fwr

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner