CVE-2026-41901 Details
Description
Thymeleaf is a server-side Java template engine for web and standalone environments. Prior to 3.1.5.RELEASE, a security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf. Although the library provides mechanisms to avoid the execution of potentially dangerous expressions in some specific sandboxed (restricted) contexts, it fails to properly neutralize specific constructs that allow this kind of expressions to be executed. If an application developer passes to the template engine unsanitized variables that contain such expressions, and these values are used in sandboxed contexts inside the templates, these expressions can be executed achieving Server-Side Template Injection (SSTI). This vulnerability is fixed in 3.1.5.RELEASE.
A security bypass vulnerability has been identified in Thymeleaf, a Java template engine, in versions prior to 3.1.5.RELEASE. This vulnerability arises in the expression execution mechanisms, where the library inadequately neutralizes certain constructs that could allow the execution of potentially dangerous expressions, particularly in sandboxed contexts. If an application developer inputs unsanitized variables containing such expressions into the template engine, these can be executed within the templates, leading to Server-Side Template Injection (SSTI).
Users are advised to upgrade to Thymeleaf version 3.1.5.RELEASE. For those using Thymeleaf with Spring, the same version should be applied. No additional workarounds are available, but it is crucial to ensure that unvalidated or unsanitized data is not passed directly to the template engine.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 12, 2026CISA-ADP
Assessed May 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/thymeleaf/thymeleaf/security/advisories/GHSA-c9ph-gxww-7744 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1336 | Improper Neutralization of Special Elements Used in a Template Engine | [email protected] |
| CWE-917 | Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Thymeleaf | <= 3.1.4.RELEASE |
CPE
Remediation
| |
| Thymeleaf Spring5 | All versions |
CPE
Remediation
| |
| Thymeleaf Spring6 | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 12, 2026 | New CVE Received | [email protected] |