TI-2026-30303 Aliases CVE-2026-41901 GHSA-c9ph-gxww-7744

Thymeleaf: Improper recognition of unauthorized syntax patterns in sandboxed Thymeleaf expressions

MEDIUM 41CWE-1336Published 2026-05-12 · Updated 2026-05-13

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Partial Red Hat: 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-1336.

Summary

Thymeleaf is a server-side Java template engine for web and standalone environments. Prior to 3.1.5.RELEASE, a security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf. Although the library provides mechanisms to avoid the execution of potentially dangerous expressions in some specific sandboxed (restricted) contexts, it fails to properly neutralize specific constructs that allow this kind of expressions to be executed. If an application developer passes to the template engine unsanitized variables that contain such expressions, and these values are used in sandboxed contexts inside the templates, these expressions can be executed achieving Server-Side Template Injection (SSTI). This vulnerability is fixed in 3.1.5.RELEASE.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00427 37th percentileScored 2026-11-07

Fix Partial thymeleaf (thymeleaf): 3.1.5.RELEASEorg.thymeleaf:thymeleaf (Maven): 3.1.5.RELEASE+2 more productsRed Hat: 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
thymeleaf	thymeleaf	before 3.1.5.RELEASE	3.1.5.RELEASE	Patch available	CNA
—	org.thymeleaf:thymeleaf (Maven)	before 3.1.5.RELEASE	3.1.5.RELEASE	Patch available	GHSA-c9ph-gxww-7744
—	org.thymeleaf:thymeleaf-spring5 (Maven)	before 3.1.5.RELEASE	3.1.5.RELEASE	Patch available	GHSA-c9ph-gxww-7744
—	org.thymeleaf:thymeleaf-spring6 (Maven)	before 3.1.5.RELEASE	3.1.5.RELEASE	Patch available	GHSA-c9ph-gxww-7744

thymeleaf Vendorthymeleaf Affected before 3.1.5.RELEASE Fixed in 3.1.5.RELEASE Patch available CNA
org.thymeleaf:thymeleaf (Maven) Vendor— Affected before 3.1.5.RELEASE Fixed in 3.1.5.RELEASE Patch available GHSA-c9ph-gxww-7744
org.thymeleaf:thymeleaf-spring5 (Maven) Vendor— Affected before 3.1.5.RELEASE Fixed in 3.1.5.RELEASE Patch available GHSA-c9ph-gxww-7744
org.thymeleaf:thymeleaf-spring6 (Maven) Vendor— Affected before 3.1.5.RELEASE Fixed in 3.1.5.RELEASE Patch available GHSA-c9ph-gxww-7744

Remediation

Fix · CNA thymeleaf (thymeleaf) Fixed in 3.1.5.RELEASE
Fix · GHSA-c9ph-gxww-7744 org.thymeleaf:thymeleaf (Maven) Fixed in 3.1.5.RELEASE Advisory →
Fix · GHSA-c9ph-gxww-7744 org.thymeleaf:thymeleaf-spring5 (Maven) Fixed in 3.1.5.RELEASE Advisory →
Fix · GHSA-c9ph-gxww-7744 org.thymeleaf:thymeleaf-spring6 (Maven) Fixed in 3.1.5.RELEASE Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Fuse 7	Affected	No fix planned: Will not fix
Red Hat Single Sign-On 7	Affected	No fix yet: Fix deferred

Not affected: 2 products

Red Hat JBoss Enterprise Application Platform Expansion Pack
Red Hat OpenShift Dev Spaces

Timeline

2026-10-02 Threatist record created from CVE-2026-41901
2026-10-03 Alias added: GHSA-c9ph-gxww-7744

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-41901

Other 2

TI-2023-19687 Thymeleaf through 3.1.1.RELEASE, as used in spring-boot-admin (aka Spring Boot Admin)… CVSS 3.1HIGH 7.5
TI-2021-19390 In the thymeleaf-spring5:3.0.12 component, thymeleaf combined with specific scenarios in… CVSS 3.1CRITICAL 9.8
TI-2026-29229 Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf CVSS 3.1CRITICAL 9.1
TI-2026-29228 Improper restriction of the scope of accessible objects in Thymeleaf expressions CVSS 3.1CRITICAL 9.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences