Analysis of Conditional Thymeleaf Template Injection Vulnerability CVE-2026-40478
A critical server-side template injection vulnerability, identified as CVE-2026-40478 with a CVSS score of 9.1, has been discovered in the Thymeleaf Java templating engine. Discovered by pentester Dawid Bakaj, this flaw allows attackers to bypass the security sandbox using a tab character, potentially leading to remote code execution. However, experts emphasize that the vulnerability is conditional and only exploitable if developers misuse the framework by allowing user-controlled input to reach the expression engine directly. Standard implementations, where user input is strictly confined to the data model while templates remain static, are not affected. The risk primarily arises from unsafe practices such as dynamic view resolution or constructing template strings with user input. To mitigate this threat, organizations are urged to immediately patch to Thymeleaf version 3.1.4 or higher. Additionally, developers must audit their codebases to identify and rectify instances of dynamic template expression misuse. This advisory serves to prevent unnecessary panic, clarifying that proper coding standards effectively neutralize the threat, distinguishing it from widespread vulnerabilities like Log4shell.
Wire timeline
Analysis of Conditional Thymeleaf Template Injection Vulnerability CVE-2026-40478
A critical server-side template injection vulnerability, identified as CVE-2026-40478 with a CVSS score of 9.1, has been discovered in the Thymeleaf Java templating engine. Discovered by pentester Dawid Bakaj, this flaw allows attackers to bypass the security sandbox using a tab character, potentially leading to remote code execution. However, experts emphasize that the vulnerability is conditional and only exploitable if developers misuse the framework by allowing user-controlled input to reach the expression engine directly. Standard implementations, where user input is strictly confined to the data model while templates remain static, are not affected. The risk primarily arises from unsafe practices such as dynamic view resolution or constructing template strings with user input. To mitigate this threat, organizations are urged to immediately patch to Thymeleaf version 3.1.4 or higher. Additionally, developers must audit their codebases to identify and rectify instances of dynamic template expression misuse. This advisory serves to prevent unnecessary panic, clarifying that proper coding standards effectively neutralize the threat, distinguishing it from widespread vulnerabilities like Log4shell.
Blog RSS Feed | Snyk