Vulnerability details

CVE-2026-40477

Red Hat Fuse 7Red Hat JBoss Enterprise Application Platform Expansion PackRed Hat Single Sign-On 7thymeleaf org.thymeleaf:thymeleaf-spring5thymeleaf org.thymeleaf:thymeleaf-spring6thymeleaf thymeleaf

Improper restriction of the scope of accessible objects in Thymeleaf expressions

CVSS 3.1

9.1Critical

Official description

Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the expression execution mechanisms. Although the library provides mechanisms to prevent expression injection, it fails to properly restrict the scope of accessible objects, allowing specific potentially sensitive objects to be reached from within a template. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library's protections to achieve Server-Side Template Injection (SSTI). This issue has ben fixed in version 3.1.4.RELEASE.

CVSS scores

Score	Version	Source	Vector
9.1Critical	3.1	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H`
8.5High	3.1	CVEProject cvelistV5 (CNA) (redhat-SADP)	`CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
Red Hat	Red Hat Fuse 7	All	CVEProject cvelistV5 (CNA)
Red Hat	Red Hat JBoss Enterprise Application Platform Expansion Pack	All	CVEProject cvelistV5 (CNA)
Red Hat	Red Hat Single Sign-On 7	All	CVEProject cvelistV5 (CNA)
Red Hat	Red Hat Single Sign-On 7	All	CVEProject cvelistV5 (CNA)
Red Hat	Red Hat Single Sign-On 7	All	CVEProject cvelistV5 (CNA)
Red Hat	Red Hat Single Sign-On 7	All	CVEProject cvelistV5 (CNA)
thymeleaf	org.thymeleaf:thymeleaf-spring5	< 3.1.4.RELEASE	CVEProject cvelistV5 (CNA)
thymeleaf	org.thymeleaf:thymeleaf-spring6	< 3.1.4.RELEASE	CVEProject cvelistV5 (CNA)
thymeleaf	thymeleaf	< 3.1.4.RELEASE	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/thymeleaf/thymeleaf/security/advisories/GHSA-r4v4-5mwr-2fwr x_refsource_CONFIRM
https://access.redhat.com/security/cve/CVE-2026-40477 vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2459344 issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40477.json x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:21772 vendor-advisoryx_refsource_REDHAT

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-04-18
Last updated: 2026-08-17
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

0.85%

Probability of exploitation in 30 days

58.3%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-1336
Improper Neutralization of Special Elements Used in a Template Engine
CWE-917
Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')