What is the CVSS score of CVE-2026-40478?

CVE-2026-40478 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-40478?

Yes, a patch is available for CVE-2026-40478. Update the affected software to the latest version immediately.

CVE-2026-40478

CRITICAL

Improper Neutralization of Special Elements used in an Expression Language Statement (CWE-917)

2026-04-15 https://github.com/thymeleaf/thymeleaf

GHSA-xjw8-8c5c-9r79

Authentication Bypass

9.0

CVSS 3.1 · Vendor: https://github.com/thymeleaf/thymeleaf

Severity by source

Vendor (https://github.com/thymeleaf/thymeleaf) PRIMARY

9.0 CRITICAL

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Red Hat

8.5 HIGH

qualitative

Primary rating from Vendor (https://github.com/thymeleaf/thymeleaf).

CVSS VectorVendor: https://github.com/thymeleaf/thymeleaf

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 26, 2026 - 15:06 vuln.today

Analysis Generated

Jul 26, 2026 - 15:06 vuln.today

CVSS changed

Apr 17, 2026 - 22:22 NVD

9.1 (CRITICAL) 9.0 (CRITICAL)

Patch released

Apr 16, 2026 - 02:30 nvd

Patch available

CVE Published

Apr 15, 2026 - 19:46 nvd

CRITICAL 9.0

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

70 maven packages depend on org.thymeleaf:thymeleaf (21 direct, 49 indirect)
61 maven packages depend on org.thymeleaf:thymeleaf-spring6 (5 direct, 56 indirect)

Ecosystem-wide dependent count for version 3.1.4.RELEASE and other introduced versions.

DescriptionCVE.org

Impact

A security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf up to and including 3.1.3.RELEASE. Although the library provides mechanisms to prevent expression injection, it fails to properly neutralize specific syntax patterns that allow for the execution of unauthorized expressions. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library's protections to achieve Server-Side Template Injection (SSTI).

Patches

This has been fixed in Thymeleaf 3.1.4.RELEASE.

Workarounds

No workaround is available beyond ensuring applications do not pass unvalidated user input directly to the template engine. Upgrading to 3.1.4.RELEASE is strongly recommended in any case.

Credits

Thanks to Dawid Bakaj (VIPentest.com) for responsible disclosure.

AnalysisAI

Server-side template injection (SSTI) in Thymeleaf 3.1.3 and prior allows unauthenticated remote attackers to bypass expression sanitization and execute unauthorized code when applications pass unvalidated user input to the template engine. The flaw stems from improper neutralization of specific syntax patterns, and a fix is available in version 3.1.4.RELEASE. No public exploit or active exploitation has been identified at the time of analysis, and EPSS indicates low exploitation probability (0.13%).