KEV Entry

CVE-2026-40478

Known Exploited Vulnerability Entry ENISA

Back to Catalog View Vulnerability
Entry Details
Confirmed Exploited

CVE-2026-40478

2026-10-10 02:00 CEST

Timestamps

2026-10-10

2026-10-10

Scope

Affected: Thymeleaf / Thymeleaf | Description: Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the the expression execution mechanisms. Although the library provides mechanisms to prevent expression injection, it fails to properly neutralize specific syntax patterns that allow for the execution of unauthorized expressions. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library's protections to achieve Server-Side Template Injection (SSTI). This issue has ben fixed in version 3.1.4.RELEASE. | Patched since: 2026/04/15 | Exploitation type: unknown | CWEs: CWE-917, CWE-1336 | Origin source: CNW | Notes: https://github.com/thymeleaf/thymeleaf/security/advisories/GHSA-xjw8-8c5c-9r79

References
  • {'id': 'CVE-2026-40478', 'url': 'https://www.cve.org/CVERecord?id=CVE-2026-40478'}
  • {'id': 'EUVD-2026-23573', 'url': 'https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-23573'}
  • {'id': 'source', 'url': 'https://github.com/thymeleaf/thymeleaf/security/advisories/GHSA-xjw8-8c5c-9r79'}

1ccc4d09-7de1-4069-9ddb-87f87dce9e44

ENISA
cce329bf-df49-4c6e-a027-80be2e6483bd

2026-10-17 06:37 CEST

2026-10-17 06:37 CEST

Evidence
1
Type Source Signal Confidence Details GCVE Metadata
csirt_report enisa-cnw-kev successful_exploitation 0.75
View details 
{
  "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON",
  "cwes": [
    "CWE-917",
    "CWE-1336"
  ],
  "dateReported": "2026/10/10",
  "euvd": "EUVD-2026-23573",
  "exploitationType": [
    "unknown"
  ],
  "notes": "https://github.com/thymeleaf/thymeleaf/security/advisories/GHSA-xjw8-8c5c-9r79",
  "originSource": "CNW",
  "patchedSince": "2026/04/15",
  "product": "Thymeleaf",
  "threatActorsExploiting": [],
  "vendorProject": "Thymeleaf",
  "vulnerabilityName": ""
}
 -
Export Options
JSON Object JSON API View Full Catalog