Read the docs
TI-2026-29228 Aliases CVE-2026-40477GHSA-r4v4-5mwr-2fwr

Improper restriction of the scope of accessible objects in Thymeleaf expressions

Priority MEDIUM 43CWE-1336Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 1 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-1336.

Summary

Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the expression execution mechanisms. Although the library provides mechanisms to prevent expression injection, it fails to properly restrict the scope of accessible objects, allowing specific potentially sensitive objects to be reached from within a template. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library's protections to achieve Server-Side Template Injection (SSTI). This issue has ben fixed in version 3.1.4.RELEASE.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00851 58th percentileScored 2026-11-07
Fix Partial thymeleaf (thymeleaf): 3.1.4.RELEASEorg.thymeleaf:thymeleaf-spring5 (thymeleaf): 3.1.4.RELEASE+4 more productsRed Hat: 1 advisoryRed Hat: 1 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
thymeleafthymeleafbefore 3.1.4.RELEASE3.1.4.RELEASEPatch availableCNA
thymeleaforg.thymeleaf:thymeleaf-spring5before 3.1.4.RELEASE3.1.4.RELEASEPatch availableCNA
thymeleaforg.thymeleaf:thymeleaf-spring6before 3.1.4.RELEASE3.1.4.RELEASEPatch availableCNA
—org.thymeleaf:thymeleaf (Maven)before 3.1.4.RELEASE3.1.4.RELEASEPatch availableGHSA-r4v4-5mwr-2fwr
—org.thymeleaf:thymeleaf-spring5 (Maven)before 3.1.4.RELEASE3.1.4.RELEASEPatch availableGHSA-r4v4-5mwr-2fwr
—org.thymeleaf:thymeleaf-spring6 (Maven)before 3.1.4.RELEASE3.1.4.RELEASEPatch availableGHSA-r4v4-5mwr-2fwr
  • thymeleaf Vendorthymeleaf Affected before 3.1.4.RELEASE Fixed in 3.1.4.RELEASE Patch available CNA
  • org.thymeleaf:thymeleaf-spring5 Vendorthymeleaf Affected before 3.1.4.RELEASE Fixed in 3.1.4.RELEASE Patch available CNA
  • org.thymeleaf:thymeleaf-spring6 Vendorthymeleaf Affected before 3.1.4.RELEASE Fixed in 3.1.4.RELEASE Patch available CNA
  • org.thymeleaf:thymeleaf (Maven) Vendor— Affected before 3.1.4.RELEASE Fixed in 3.1.4.RELEASE Patch available GHSA-r4v4-5mwr-2fwr
  • org.thymeleaf:thymeleaf-spring5 (Maven) Vendor— Affected before 3.1.4.RELEASE Fixed in 3.1.4.RELEASE Patch available GHSA-r4v4-5mwr-2fwr
  • org.thymeleaf:thymeleaf-spring6 (Maven) Vendor— Affected before 3.1.4.RELEASE Fixed in 3.1.4.RELEASE Patch available GHSA-r4v4-5mwr-2fwr

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:thymeleaf:thymeleaf:*:*:*:*:*:*:*:*before 3.1.4Vulnerablethymeleaf
  • cpe:2.3:a:thymeleaf:thymeleaf:*:*:*:*:*:*:*:* Versions before 3.1.4 Vulnerable ·thymeleaf

Remediation

  • Fix · CNA thymeleaf (thymeleaf) Fixed in 3.1.4.RELEASE
  • Fix · CNA org.thymeleaf:thymeleaf-spring5 (thymeleaf) Fixed in 3.1.4.RELEASE
  • Fix · CNA org.thymeleaf:thymeleaf-spring6 (thymeleaf) Fixed in 3.1.4.RELEASE
  • Fix · GHSA-r4v4-5mwr-2fwr org.thymeleaf:thymeleaf (Maven) Fixed in 3.1.4.RELEASE Advisory →
  • Fix · GHSA-r4v4-5mwr-2fwr org.thymeleaf:thymeleaf-spring5 (Maven) Fixed in 3.1.4.RELEASE Advisory →
  • Fix · GHSA-r4v4-5mwr-2fwr org.thymeleaf:thymeleaf-spring6 (Maven) Fixed in 3.1.4.RELEASE Advisory →

Red Hat 1 advisory

  • RHSA-2026:21772 Released 2026-05-28 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.28.0 Release.
    • Red Hat OpenShift Dev Spaces 3.28 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/openvsx-rhel9 +3

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat Single Sign-On 7AffectedNo fix planned: Will not fix
Red Hat OpenShift Dev Spaces 3.28Fixed RHSA-2026:21772
Not affected: 5 products
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat OpenShift Dev Spaces 3.28
  • Red Hat build of Apache Camel for Spring Boot 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-40477
  2. 2026-10-03 Alias added: GHSA-r4v4-5mwr-2fwr

References

Advisory 2

Other 1

  • TI-2023-19687 Thymeleaf through 3.1.1.RELEASE, as used in spring-boot-admin (aka Spring Boot Admin)… CVSS 3.1HIGH 7.5
  • TI-2021-19390 In the thymeleaf-spring5:3.0.12 component, thymeleaf combined with specific scenarios in… CVSS 3.1CRITICAL 9.8
  • TI-2026-29229 Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf CVSS 3.1CRITICAL 9.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences