Home / Vulnerability Intelligence / CVE-2026-41901

CVE-2026-41901 - Vulnerability Analysis

CriticalCVSS: 9.0

Last Updated: May 13, 2026

Thymeleaf - Server-Side Template Injection

Published: May 12, 2026Updated: May 13, 2026Remote Exploitable

Overview

Thymeleaf < 3.1.5.RELEASE contains a server-side template injection caused by improper neutralization of dangerous expressions in sandboxed contexts, letting attackers execute arbitrary template expressions, exploit requires unsanitized user input in templates.

Severity & Score

Severity: Critical

CVSS Score: 9.0

Impact

Attackers can execute arbitrary server-side template expressions, potentially leading to remote code execution or data compromise.

Mitigation

Upgrade to version 3.1.5.RELEASE or later.

References

https://github.com/thymeleaf/thymeleaf/security/advisories/GHSA-c9ph-gxww-7744

Related Resources

Details

CVE ID: CVE-2026-41901
Severity: Critical
CVSS Score: 9.0
Type: template_injection
Status: rejected

CWE

CWE-917

CVSS Metrics

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H