#!/bin/bash
# CVE-2026-41901 Docker POC with Visible RCE Output
set -e
PROJECT_NAME="thymeleaf-cve-2026-41901-rce"
mkdir -p $PROJECT_NAME/src/main/java/com/example
mkdir -p $PROJECT_NAME/src/main/resources/templates
cd $PROJECT_NAME
# pom.xml (same vulnerable version)
cat > pom.xml << 'EOF'
4.0.0
com.example
thymeleaf-cve-poc
1.0
org.springframework.boot
spring-boot-starter-parent
3.2.0
org.springframework.boot
spring-boot-starter-web
org.springframework.boot
spring-boot-starter-thymeleaf
org.thymeleaf
thymeleaf
3.1.4.RELEASE
org.springframework.boot
spring-boot-maven-plugin
EOF
# Main Application
cat > src/main/java/com/example/ThymeleafPocApplication.java << 'EOF'
package com.example;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestParam;
@SpringBootApplication
@Controller
public class ThymeleafPocApplication {
public static void main(String[] args) {
SpringApplication.run(ThymeleafPocApplication.class, args);
}
@GetMapping("/poc")
public String poc(@RequestParam String input, Model model) {
model.addAttribute("userInput", input);
return "poc";
}
}
EOF
# Improved Template - Better for output reflection
cat > src/main/resources/templates/poc.html << 'EOF'
CVE-2026-41901 RCE POC
Thymeleaf CVE-2026-41901 - Remote Command Execution
Command Output:
EOF
# Dockerfile
cat > Dockerfile << 'EOF'
FROM maven:3.9.6-eclipse-temurin-21 AS build
WORKDIR /app
COPY . .
RUN mvn clean package -DskipTests
FROM eclipse-temurin:21-jre
WORKDIR /app
COPY --from=build /app/target/thymeleaf-cve-poc-1.0.jar app.jar
EXPOSE 8080
ENTRYPOINT ["java", "-jar", "app.jar"]
EOF
echo "[+] Building Docker image..."
docker build -t thymeleaf-cve-2026-41901-rce:latest .
echo "[+] Starting container..."
docker run -d --name thymeleaf-rce -p 8080:8080 thymeleaf-cve-2026-41901-rce:latest
echo ""
echo "=================================================="
echo "✅ Docker RCE POC is ready!"
echo "Test URL: http://localhost:8080/poc?input=TEST"
echo "=================================================="