SEPPmail AG Secure Email Gateway prior to version 15.0.4 contains a server-side template injection vulnerability (CWE-1336) in the new GINA UI. This occurs because an endpoint improperly neutralizes special elements in templates, allowing attackers to submit malicious templates. Successful exploitation allows execution of arbitrary template expressions remotely, which may lead to remote code execution depending on the configuration of template plugins. The CVSS 4.0 base score is 8.3, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, but partial impact on confidentiality, integrity, and availability.

The vulnerability allows remote attackers to execute arbitrary template expressions on the affected SEPPmail Secure Email Gateway, potentially leading to remote code execution. This can compromise the confidentiality, integrity, and availability of the system. The impact depends on the enabled template plugins, which may extend the attacker's capabilities. No known exploits have been reported, but the high CVSS score reflects significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor SEPPmail AG advisories for updates. Until a patch is available, consider restricting access to the vulnerable endpoint and disabling or limiting template plugins if possible to reduce exposure.