Thymeleaf SSTI Bypass Enables Expression Injection in Spring Java Apps

A critical flaw tracked as CVE-2026-40478 allows attackers to bypass Thymeleaf’s expression-injection protections and achieve server-side template injection (SSTI) in applications that pass unvalidated user input into the template engine. The vulnerability affects Thymeleaf 3.1.3.RELEASE and earlier and stems from improper neutralization of syntax patterns in expression execution, including a whitespace parsing mismatch that let attackers evade detection of the SpEL new keyword and an incomplete type blocklist that still allowed dangerous class instantiation. The issue is mapped to CWE-917 and CWE-1336, with a published CVSS v3.1 vector of AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H.

Researchers said successful exploitation can enable arbitrary file writes and potentially remote code execution in Spring-based Java applications, where Thymeleaf is commonly used as the default template engine in Spring Boot. The flaw can be exploited remotely without authentication when attacker-controlled input reaches Thymeleaf expression parsing, view names, or fragment selectors. The issue is addressed in 3.1.4.RELEASE, which normalizes whitespace before checks, expands external-access detection, restricts dangerous expression objects, and tightens type restrictions; defenders are urged to upgrade thymeleaf, thymeleaf-spring5, and thymeleaf-spring6 and review applications to ensure untrusted input is never interpreted as template expressions.