CVE-2026-40478 - Vulnerability Analysis

Overview

Thymeleaf <= 3.1.3.RELEASE contains a server-side template injection caused by improper neutralization of specific syntax patterns in expression execution, letting unauthenticated remote attackers execute unauthorized expressions, exploit requires unvalidated user input passed to the template engine.

Severity & Score

Impact

Unauthenticated remote attackers can execute unauthorized server-side template expressions, potentially leading to remote code execution or data compromise.

Mitigation

Upgrade to version 3.1.4.RELEASE or later.

References

• https://github.com/thymeleaf/thymeleaf/security/advisories/GHSA-xjw8-8c5c-9r79

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner