Thymeleaf SpEL Injection Remote Code Execution (CVE-2026-41901)

Metadata

Affected Target

Summary

The PoC reproduces a Spring Expression Language (SpEL) injection in a Thymeleaf-rendered template where user-controlled input is reflected into a template expression context without sanitization. By submitting a crafted SpEL payload such as [[${T(java.lang.Runtime).getRuntime().exec("id")}]] as the input query parameter, an attacker can get the Thymeleaf engine to evaluate the expression and invoke arbitrary Java classes, including java.lang.Runtime, achieving remote command execution on the server. The included lab setup script builds a minimal vulnerable Spring Boot/Thymeleaf application in Docker, and the exploit script sends a battery of SpEL payloads to demonstrate command execution and output capture via java.util.Scanner.

Vulnerability Details

Root Cause

The vulnerable controller passes attacker-controlled input directly into a Thymeleaf template attribute (th:text="${userInput}" and inline expressions), and the template additionally contains a SpEL expression that invokes T(java.lang.Runtime).getRuntime().exec(...), allowing arbitrary command execution when the expression is evaluated with attacker input.

Attack Vector

1. Attacker identifies a Thymeleaf-rendered endpoint (e.g. /poc?input=...) that reflects user input into the template context.
2. Attacker submits a SpEL payload such as [[${T(java.util.Scanner).new(T(java.lang.Runtime).getRuntime().exec("id").getInputStream()).useDelimiter("\A").next()}]] via the input parameter.
3. Thymeleaf evaluates the SpEL expression server-side, invoking Runtime.exec() with the attacker-supplied command.
4. The command’s output is captured via java.util.Scanner and reflected back in the HTTP response, giving the attacker semi-interactive command execution and output retrieval.

Impact

Full remote code execution on the Spring Boot server as the application’s runtime user, with the ability to read arbitrary files and execute arbitrary OS commands.

Environment / Lab Setup

Target:   Spring Boot 3.2.0 app with Thymeleaf 3.1.4.RELEASE, packaged in Docker (thymeleaf-rce container, port 8080)
Attacker: bash, curl, Docker (to build/run the vulnerable lab)

Proof of Concept

PoC Script

See setup-lab.sh and exploit-cve-2026-41901.sh in this folder.

1

bash setup-lab.sh && bash exploit-cve-2026-41901.sh

setup-lab.sh scaffolds and builds a minimal vulnerable Spring Boot/Thymeleaf application in Docker and exposes it on port 8080. exploit-cve-2026-41901.sh then sends a series of SpEL injection payloads (id, whoami, hostname, ls /tmp, cat /etc/passwd) to the /poc endpoint and prints any command output reflected in the response.

Detection & Indicators of Compromise

Signs of compromise:

• Web server or WAF logs showing T(java.lang.Runtime), ProcessBuilder, or [[${...}]] sequences in request parameters
• Unexpected child processes spawned by the Java/Spring Boot process
• Command output (e.g. /etc/passwd contents, id/whoami output) appearing in HTTP responses

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/HORKimhab/CVE-2026-41901 on 2026-07-05.