The GBIF Integrated Publishing Toolkit versions prior to 3.3.4 contain a vulnerability classified as CWE-1336, where untrusted input is improperly neutralized in the template engine. This flaw enables remote authenticated attackers to inject templates, potentially accessing sensitive server-side files and internal state. The CVSS 4.0 base score is 7.6, indicating a high severity with network attack vector, high attack complexity, and limited privileges required. No vendor advisory or patch information is available to confirm remediation status.

Successful exploitation allows remote authenticated attackers to access server-side files and internal state data via template injection. This could lead to unauthorized disclosure of sensitive information within the affected system. The attack requires authentication and has high complexity, limiting the ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the template engine to trusted users only and monitor for suspicious activity related to template processing.