What is the CVSS score of CVE-2026-40478?

CVE-2026-40478 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-40478?

Yes, a patch is available for CVE-2026-40478. Update the affected software to the latest version immediately.

CVE-2026-40478

CRITICAL

Improper Neutralization of Special Elements used in an Expression Language Statement (CWE-917)

2026-04-15 https://github.com/thymeleaf/thymeleaf

GHSA-xjw8-8c5c-9r79

Authentication Bypass

9.0

CVSS 3.1 · Vendor: https://github.com/thymeleaf/thymeleaf

Severity by source

Vendor (https://github.com/thymeleaf/thymeleaf) PRIMARY

9.0 CRITICAL

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Red Hat

8.5 HIGH

qualitative

Primary rating from Vendor (https://github.com/thymeleaf/thymeleaf).

CVSS VectorVendor: https://github.com/thymeleaf/thymeleaf

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Apr 17, 2026 - 22:22 NVD

9.1 (CRITICAL) 9.0 (CRITICAL)

Patch released

Apr 16, 2026 - 02:30 nvd

Patch available

CVE Published

Apr 15, 2026 - 19:46 nvd

CRITICAL 9.0

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

70 maven packages depend on org.thymeleaf:thymeleaf (21 direct, 49 indirect)
61 maven packages depend on org.thymeleaf:thymeleaf-spring6 (5 direct, 56 indirect)

Ecosystem-wide dependent count for version 3.1.4.RELEASE and other introduced versions.

DescriptionCVE.org

Impact

A security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf up to and including 3.1.3.RELEASE. Although the library provides mechanisms to prevent expression injection, it fails to properly neutralize specific syntax patterns that allow for the execution of unauthorized expressions. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library's protections to achieve Server-Side Template Injection (SSTI).

Patches

This has been fixed in Thymeleaf 3.1.4.RELEASE.

Workarounds

No workaround is available beyond ensuring applications do not pass unvalidated user input directly to the template engine. Upgrading to 3.1.4.RELEASE is strongly recommended in any case.

Credits

Thanks to Dawid Bakaj (VIPentest.com) for responsible disclosure.

Analysis

Impact

Patches

This has been fixed in Thymeleaf 3.1.4.RELEASE.

Workarounds

No workaround is available beyond ensuring applications do not pass unvalidated user input directly to the template engine. Upgrading to 3.1.4.RELEASE is strongly recommended in any case.