CVE-2026-40477

Overview

Thymeleaf is a modern server-side Java template engine for both web and standalone environments. It processes HTML, XML, text, JavaScript and CSS templates and is widely used as the view layer of Spring MVC and Spring Boot applications. Thymeleaf 3.0.x is the legacy line; Thymeleaf 3.1.x is the current upstream line.

A remote code execution vulnerability (CVE-2026-40477) has been identified in Thymeleaf's restricted expression mode, which allows attackers who can get unvalidated input into a template expression to reach sensitive expression objects and bypass the engine's expression-injection protections, leading to Server-Side Template Injection (SSTI).

Per OWASP: Code Injection is the general term for attack types which consist of injecting code that is then interpreted/executed by the application. This type of attack exploits poor handling of untrusted data.

This issue affects all versions of Thymeleaf up to and including 3.1.3.RELEASE.

Details

Module Info

• Product: Thymeleaf
• Affected packages: org.thymeleaf:thymeleaf, org.thymeleaf:thymeleaf-spring5, org.thymeleaf:thymeleaf-spring6
• Affected versions: <=3.1.3.RELEASE
• GitHub repository: https://github.com/thymeleaf/thymeleaf
• Published packages: https://central.sonatype.com/artifact/org.thymeleaf/thymeleaf
• Package manager: Maven
• Fixed in:
  • OSS Thymeleaf 3.1.4.RELEASE
  • NES for Thymeleaf v3.0.17

Vulnerability Info

This Critical-severity vulnerability is found in the org.thymeleaf:thymeleaf package in all versions of Thymeleaf up to and including 3.1.3.RELEASE.

Thymeleaf evaluates expressions that may carry untrusted input, such as unescaped text (th:utext), text-mode output and inlining, expression preprocessing (__${...}__), and fragment and link expressions, in a restricted execution mode. Restricted mode is the engine's expression-injection protection: it forbids object instantiation and static access, and it wraps the request object so that request parameters cannot be read.

The restriction only covers the request objects. OGNLExpressionObjectsWrapper.get() hands every other expression object to a restricted expression unchanged, including the ones that expose the live evaluation context: #ctx, #vars, #root, #this and #execInfo.

@Override
public Object get(final Object key) {

    if (this.expressionObjects.containsObject(key.toString())) {

        final Object expressionObject = this.expressionObjects.getObject(key.toString());

        // We need to first check if we are in a restricted environment. If so, restrict access to the request.
        if (this.restrictedExpressionExecution &&
                (StandardExpressionObjectFactory.REQUEST_EXPRESSION_OBJECT_NAME.equals(key) ||
                 StandardExpressionObjectFactory.HTTP_SERVLET_REQUEST_EXPRESSION_OBJECT_NAME.equals(key))) {
            return RestrictedRequestAccessUtils.wrapRequestObject(expressionObject);
        }

        return expressionObject;
    }

    return super.get(key);

}

Method calls on reachable objects are not restricted, so an injected expression can start from one of these objects and walk to whatever it exposes. From #ctx, that includes the unwrapped request, the response and the servlet context. The request-parameter restriction is bypassed with an expression as short as ${#ctx.getRequest().getParameter('name')}, and the same reach is the starting point for full template injection.

Steps to Reproduce

1. Process a template whose th:utext attribute, a restricted context, evaluates an expression that references #ctx, as an injected expression would:

   <div th:utext="${#ctx.getVariable('somevar')}">...</div>

2. On an affected version, the template renders the variable's value. A version with the fix rejects the expression with "Access to variable '#ctx' is forbidden in this context."

Mitigation

Older versions of Thymeleaf are End-of-Life and will not receive any updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade applications to a supported version of Thymeleaf.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Thomas Reburn from Praetorian (finder)