CVE-2026-40478
Thymeleaf versions 3.1.3.RELEASE and earlier allow attackers to inject and run arbitrary expressions on the server. The vulnerability bypasses the engine’s protection mechanisms. It has been fixed in 3.1.4.RELEASE.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Java applications that use Thymeleaf 3.1.3.RELEASE or earlier as a template engine.
Real-world impact
An attacker can execute arbitrary code on the server, read or modify data, and potentially take full control of the affected system.
Why this severity
The CVSS score of 9 reflects that the attack requires no user interaction, no privileges, and can compromise confidentiality, integrity, and availability. The high attack complexity indicates that the attacker must craft a specific payload, but once done the impact is complete.
What to do about it
- 01Upgrade Thymeleaf to version 3.1.4.RELEASE or later.
- 02Verify that the application is using the updated library.
- 03Restart the application to load the new version.
NVD-referenced vendor advisory
Timeline
- Apr 17, 2026 · Apr 17, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Aug 4, 2026 · 14h agoAdvisory updatedThe NVD record was last revised.
- Aug 4, 2026 · 12h agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.