CVE-2026-40477

What it actually does

The flaw is a security bypass in Thymeleaf's expression execution controls. In affected versions 3.1.3.RELEASE and earlier, Thymeleaf does not sufficiently restrict which objects can be reached from within template expressions. If an application incorporates untrusted input directly into a template or template expression, an unauthenticated remote attacker may be able to perform server-side template injection. Depending on the application context, reachable objects, enabled integrations, and runtime permissions, this can lead to arbitrary expression evaluation, disclosure of sensitive data, modification of server-side behavior, or remote code execution under the privileges of the application process.

Why it matters to the business

Applications that use vulnerable Thymeleaf versions and render unvalidated user-controlled input may expose critical server-side functionality to internet-based attackers. Successful exploitation could result in data theft, service disruption, tampering with application responses or business logic, and potentially full compromise of the application server. The CVSS score is critical, but the attack requires a vulnerable application pattern, so organizations should prioritize internet-facing and user-input-heavy Java applications first. The vulnerability is not currently listed in CISA KEV, has no reported ransomware association, and has a low, flat EPSS score, which lowers evidence of broad active exploitation but does not reduce the severity where the vulnerable pattern exists.

How an attack unfolds

An attacker first identifies an application endpoint that reflects or processes user-supplied content through Thymeleaf, such as a search field, profile field, message template, preview function, email template, error page, or dynamic page fragment. The attacker submits template-expression syntax and observes whether the response changes, errors, or evaluates the expression. If evaluation occurs, the attacker iteratively probes which Thymeleaf, Spring Expression Language, OGNL, Java, or application objects are reachable despite the intended protections. By abusing the bypass, the attacker may access sensitive objects that should have been restricted. In the worst case, if dangerous Java runtime or process-execution paths are reachable and the application process has sufficient privileges, the attacker can execute commands, read files, access secrets available to the process, or pivot to other application resources.

How to fix it

Upgrade Thymeleaf to version 3.1.4.RELEASE or later across all applications and transitive dependency paths. Because this issue is only exploitable when untrusted input is passed directly into template rendering, also review application code for unsafe dynamic template construction, user-controlled template names, user-controlled fragments, and unescaped expression injection. Do not concatenate raw user input into Thymeleaf templates or expression contexts. Prefer safe variable binding, strict allowlists, contextual output encoding, and framework-supported escaping. Disable or restrict features that allow dynamic template evaluation where not required. Where immediate upgrade is not possible, mitigate by blocking user-controlled template expressions at input boundaries, removing endpoints that render arbitrary templates or previews, restricting application runtime permissions, and isolating affected services from sensitive networks and credentials.

How to confirm the fix worked

Confirm that dependency resolution uses Thymeleaf 3.1.4.RELEASE or later, including transitive dependencies in Maven, Gradle, application bundles, containers, and shaded JARs. Use software composition analysis, `mvn dependency:tree`, `gradle dependencies`, SBOM tooling, or image scanners to verify no runtime artifact includes Thymeleaf 3.1.3.RELEASE or earlier. Test representative user-input fields by submitting harmless template-expression strings and confirming they are rendered as literal text or safely escaped, not evaluated. Review code for calls that process user-controlled strings as templates, template names, fragments, or expressions. After patching, regression-test pages, email templates, preview features, and error handlers that use Thymeleaf to ensure functionality remains intact and unsafe expression evaluation is blocked.

Typical attack path

1. Identify a Java web application using Thymeleaf or behavior consistent with server-side template rendering.
2. Find an endpoint where user-controlled input is rendered into a Thymeleaf template without strict validation or escaping.
3. Submit benign template expressions to test whether the server evaluates input rather than displaying it literally.
4. Trigger the Thymeleaf expression-scope bypass to reach objects that should normally be inaccessible.
5. Enumerate accessible objects, environment values, application properties, files, or framework context data.
6. Escalate from expression evaluation to sensitive data access, application manipulation, or command execution if dangerous objects and permissions are available.
7. Use obtained credentials, secrets, or code-execution capability to maintain access, move laterally, or disrupt service.

How to detect it

Look for evidence of attempted server-side template injection in HTTP access logs, reverse proxy logs, WAF logs, application logs, Java exception logs, and APM traces. Focus on requests containing Thymeleaf, SpringEL, OGNL, or Java expression syntax, especially where parameters, headers, form fields, JSON bodies, template names, or fragment identifiers include `${...}`, `__${...}__`, class references, runtime execution calls, or process-builder strings. Review application logs for Thymeleaf exceptions such as template parsing, expression evaluation, or access-control errors around the same timestamps. Investigate successful-looking probes where the HTTP response contains evaluated arithmetic, environment values, system properties, file contents, stack traces, or command output. On hosts, correlate suspicious requests with unexpected child processes spawned by the Java application, outbound network connections from the application process, reads of secret/configuration files, or new files written by the service account. Threat intelligence currently does not indicate known named actor exploitation, KEV listing, or ransomware use for this issue, so detection should emphasize behavioral evidence and generic SSTI payloads rather than actor-specific infrastructure.

• __${
• ${T(java.lang.Runtime)
• T(java.lang.Runtime).getRuntime
• getRuntime().exec(
• java.lang.ProcessBuilder
• new ProcessBuilder(
• T(java.lang.ProcessBuilder)
• ${7*7}
• ${{7*7}}
• org.thymeleaf.exceptions.TemplateProcessingException
• org.thymeleaf.exceptions.TemplateInputException
• Exception evaluating SpringEL expression
• Exception evaluating OGNL expression
• SPEL
• th:utext
• th:with
• java.lang.System.getenv
• java.lang.System.getProperty
• /etc/passwd
• cmd.exe /c
• /bin/sh -c

What your security team should do

• Inventory all Java applications, containers, and build artifacts that include Thymeleaf 3.1.3.RELEASE or earlier.
• Prioritize remediation for internet-facing applications, authentication-adjacent flows, administrative portals, messaging or email-template features, and any feature that renders user-supplied content.
• Upgrade to Thymeleaf 3.1.4.RELEASE or later and rebuild/redeploy affected services rather than only changing source dependency declarations.
• Perform targeted secure-code review for dynamic template construction, untrusted template names, user-editable templates, preview endpoints, and use of unescaped rendering such as raw HTML insertion.
• Add negative tests to CI/CD that verify common template-expression probes are not evaluated when supplied as user input.
• Harden runtime permissions for Java services so successful expression injection cannot easily read secrets, spawn processes, or write to sensitive paths.
• Search historical web, application, and error logs for Thymeleaf/SpringEL/OGNL expression probes and unusual template-processing exceptions.
• Because the issue is not in KEV and EPSS is low and flat, use risk-based prioritization, but do not defer fixes for exposed applications that process untrusted content through Thymeleaf.