Vulnerabilities

TI-2026-30303 CVE-2026-41901 · GHSA-c9ph-gxww-7744

Thymeleaf: Improper recognition of unauthorized syntax patterns in sandboxed Thymeleaf expressions

MEDIUM 41

Thymeleaf is a server-side Java template engine for web and standalone environments.

CVSS 3.1CRITICAL 9.0 Network No auth No interaction EPSS 0.00427 Published 2026-05-12 Partial fix · 3.1.5.RELEASE CWE-1336

TI-2026-29229 CVE-2026-40478 · GHSA-xjw8-8c5c-9r79

Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf

MEDIUM 43

Thymeleaf is a server-side Java template engine for web and standalone environments.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01102 Published 2026-04-17 Partial fix · 3.1.4.RELEASE CWE-1336

TI-2026-29228 CVE-2026-40477 · GHSA-r4v4-5mwr-2fwr

Improper restriction of the scope of accessible objects in Thymeleaf expressions

MEDIUM 43

Thymeleaf is a server-side Java template engine for web and standalone environments.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00851 Published 2026-04-17 Partial fix · 3.1.4.RELEASE CWE-1336

TI-2023-19687 CVE-2023-38286 · GHSA-7gj7-224w-vpr3

Thymeleaf through 3.1.1.RELEASE, as used in spring-boot-admin (aka Spring Boot Admin)…

HIGH 68

Thymeleaf through 3.1.1.RELEASE, as used in spring-boot-admin (aka Spring Boot Admin) through 3.1.1 and other products, allows sandbox bypass via crafted HTML.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00966 Published 2023-07-14 Fixed in 3.1.2, 2.7.16 CWE-77

TI-2021-19390 CVE-2021-43466 · GHSA-qcj6-jqrg-4wp2

In the thymeleaf-spring5:3.0.12 component, thymeleaf combined with specific scenarios in…

MEDIUM 49

In the thymeleaf-spring5:3.0.12 component, thymeleaf combined with specific scenarios in template injection may lead to remote code execution.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03993 Published 2021-11-09 Fixed in 3.0.13.RELEASE CWE-94

Vulnerabilities

Filters

Thymeleaf: Improper recognition of unauthorized syntax patterns in sandboxed Thymeleaf expressions

Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf

Improper restriction of the scope of accessible objects in Thymeleaf expressions

Thymeleaf through 3.1.1.RELEASE, as used in spring-boot-admin (aka Spring Boot Admin)…

In the thymeleaf-spring5:3.0.12 component, thymeleaf combined with specific scenarios in…