CVE-2026-40477 - Vulnerability Analysis

Overview

Thymeleaf <= 3.1.3.RELEASE contains a server-side template injection caused by improper restriction of accessible objects in expression execution, letting unauthenticated remote attackers bypass protections, exploit requires unvalidated user input passed to templates.

Severity & Score

Impact

Unauthenticated remote attackers can execute arbitrary server-side template code, potentially leading to full server compromise.

Mitigation

Upgrade to version 3.1.4.RELEASE or later.

References

• https://github.com/thymeleaf/thymeleaf/security/advisories/GHSA-r4v4-5mwr-2fwr

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Apr 18, 2026

🔴 CVE-2026-40477 - Critical (9) Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the expression execution mechanisms. Although the library provides mechanisms to preve... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-40477/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner