This vulnerability involves improper neutralization of special elements used in the template engine of Wirtualna Uczelnia, specifically in the redirectToUrl endpoint's redirectUrlParameter. Insufficient input validation allows attackers to inject malicious template expressions that the server executes, resulting in remote code execution. The CVSS 4.0 base score is 9.3, indicating a critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary code on the server hosting Wirtualna Uczelnia. This includes running commands remotely and potentially establishing reverse shells, which can lead to full system compromise. The vulnerability severely impacts confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected endpoint if possible and monitor for suspicious activity related to template injection. Avoid exposing the redirectToUrl endpoint publicly or implement strict input validation and filtering as a temporary mitigation.