SEPPmail Secure Email Gateway versions before 15.1.1 contain a critical vulnerability that allows unauthenticated remote attackers to execute operating system commands as root. This occurs because attacker-controlled replacement text in sender or recipient replacement rules can be evaluated as Perl code. The flaw enables command execution in the mail-processing worker context when a matching active rule uses message-derived replacement data.