SEPPmail AG Secure Email Gateway prior to version 15.0.4 contains a server-side template injection vulnerability (CWE-1336) in the new GINA UI. An endpoint improperly neutralizes special elements in templates by accepting attacker-controlled input, enabling remote attackers to execute arbitrary template expressions. This may lead to remote code execution depending on the template plugins enabled. The vulnerability has a CVSS 4.0 base score of 8.3, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality.

Successful exploitation allows remote attackers to execute arbitrary template expressions on the server, potentially leading to remote code execution. This compromises the confidentiality and integrity of the affected system. The severity is high (CVSS 8.3), reflecting significant risk to systems running vulnerable versions prior to 15.0.4.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint and monitor for suspicious activity related to template injection attempts. Avoid enabling unnecessary template plugins that could increase exploitation risk.