fix(deps): update dependency org.thymeleaf:thymeleaf to v3.1.5.release [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
org.thymeleaf:thymeleaf (source)	3.1.2.RELEASE → 3.1.5.RELEASE

---

Improper restriction of the scope of accessible objects in Thymeleaf expressions

CVE-2026-40477 / GHSA-r4v4-5mwr-2fwr

More information

Details

Impact

A security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf up to and including 3.1.3.RELEASE. Although the library provides mechanisms to prevent expression injection, it fails to properly restrict the scope of accessible objects, allowing specific potentially sensitive objects to be reached from within a template. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library's protections to achieve Server-Side Template Injection (SSTI).

Patches

This has been fixed in Thymeleaf 3.1.4.RELEASE.

Workarounds

No workaround is available beyond ensuring applications do not pass unvalidated user input directly to the template engine. Upgrading to 3.1.4.RELEASE is strongly recommended in any case.

Credits

Thanks to Thomas Reburn (Praetorian) for responsible disclosure.

Severity

• CVSS Score: 9.0 / 10 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

References

• https://github.com/thymeleaf/thymeleaf/security/advisories/GHSA-r4v4-5mwr-2fwr
• https://nvd.nist.gov/vuln/detail/CVE-2026-40477
• https://github.com/advisories/GHSA-r4v4-5mwr-2fwr

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Improper neutralization of specific syntax patterns for unauthorized expressions in Thymeleaf

CVE-2026-40478 / GHSA-xjw8-8c5c-9r79

More information

Details

Impact

A security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf up to and including 3.1.3.RELEASE. Although the library provides mechanisms to prevent expression injection, it fails to properly neutralize specific syntax patterns that allow for the execution of unauthorized expressions. If an application developer passes unvalidated user input directly to the template engine, an unauthenticated remote attacker can bypass the library's protections to achieve Server-Side Template Injection (SSTI).

Patches

This has been fixed in Thymeleaf 3.1.4.RELEASE.

Workarounds

No workaround is available beyond ensuring applications do not pass unvalidated user input directly to the template engine. Upgrading to 3.1.4.RELEASE is strongly recommended in any case.

Credits

Thanks to Dawid Bakaj (VIPentest.com) for responsible disclosure.

Severity

• CVSS Score: 9.0 / 10 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

References

• https://github.com/thymeleaf/thymeleaf/security/advisories/GHSA-xjw8-8c5c-9r79
• https://nvd.nist.gov/vuln/detail/CVE-2026-40478
• https://github.com/advisories/GHSA-xjw8-8c5c-9r79

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Sandboxed Thymeleaf expressions vulnerable to improper recognition of unauthorized syntax patterns

CVE-2026-41901 / GHSA-c9ph-gxww-7744

More information

Details

Impact

A security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf up to and including 3.1.4.RELEASE. Although the library provides mechanisms to avoid the execution of potentially dangerous expressions in some specific sandboxed (restricted) contexts, it fails to properly neutralize specific constructs that allow this kind of expressions to be executed. If an application developer passes to the template engine unsanitized variables that contain such expressions, and these values are used in sandboxed contexts inside the templates, these expressions can be executed achieving Server-Side Template Injection (SSTI).

Patches

This has been fixed in Thymeleaf 3.1.5.RELEASE. All users are advised to upgrade immediately.

Workarounds

No workaround is available beyond ensuring applications do not pass unvalidated/unsanitized data directly to the template engine. Upgrading to 3.1.5.RELEASE is strongly recommended in any case.

Severity

• CVSS Score: 9.0 / 10 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

References

• https://github.com/thymeleaf/thymeleaf/security/advisories/GHSA-c9ph-gxww-7744
• https://nvd.nist.gov/vuln/detail/CVE-2026-41901
• https://github.com/advisories/GHSA-c9ph-gxww-7744

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.