CVE-2026-40477
Thymeleaf, a Java template engine, has a critical flaw that lets attackers inject code into templates when user input is not validated. The bug allows remote attackers to read or modify data on the server. It was fixed in Thymeleaf 3.1.4.RELEASE.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Java applications using Thymeleaf 3.1.3.RELEASE or earlier, especially those that pass unvalidated user input directly to the template engine.
Real-world impact
An attacker could run arbitrary code inside the template engine, potentially reading sensitive files, database contents, or executing commands on the server.
Why this severity
The CVSS score of 9 reflects that the vulnerability can be exploited over the network, requires no user interaction, and gives the attacker full control over the server once the template injection succeeds.
What to do about it
- 01Upgrade Thymeleaf to version 3.1.4.RELEASE or later.
NVD-referenced vendor advisory
Timeline
- Apr 17, 2026 · Apr 17, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 14h agoAdvisory updatedThe NVD record was last revised.
- Aug 4, 2026 · 12h agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.