EUVD-2026-28589
GHSA-wc7f-vvj8-28m9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
SEPPmail Secure Email Gateway before version 15.0.4 contains a server-side template injection vulnerability in the new GINA UI because an endpoint accepts attacker-controlled template, allowing remote attackers to execute arbitrary template expressions and potentially achieve remote code execution depending on the enabled template plugins.
AnalysisAI
Remote code execution in SEPPmail Secure Email Gateway versions before 15.0.4 allows unauthenticated attackers to execute arbitrary template expressions through a server-side template injection flaw in the GINA UI endpoint. The vulnerability requires no authentication and has low attack complexity, but depends on specific template plugin configurations (CVSS 4.0: 8.3 High with AT:P indicating present attack conditions). No public exploit code or active exploitation confirmed at time of analysis. EPSS data not available.
Technical ContextAI
This is a server-side template injection (SSTI) vulnerability classified under CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine). The GINA UI (presumably the administrative or user interface component) in SEPPmail Secure Email Gateway exposes an endpoint that directly processes attacker-supplied input as template code without proper sanitization. Template engines like Jinja2, Freemarker, Velocity, or similar are designed to dynamically generate content but become dangerous when user input is directly embedded into templates. The actual exploitability and impact depend on which template plugins are enabled in the deployment - some plugins provide direct access to system functions, file I/O, or reflection capabilities that enable full remote code execution, while limited plugin configurations may restrict attackers to information disclosure or logic manipulation. The CPE identifier (cpe:2.3:a:seppmail_ag:secure_email_gateway) confirms this affects SEPPmail AG's email security gateway product across all versions prior to the patched release.
RemediationAI
Upgrade to SEPPmail Secure Email Gateway version 15.0.4 or later as documented in the vendor security advisory at https://downloads.seppmail.com/extrelnotes/150/ERN15.0.html#security. The vendor-released patch addresses the template injection flaw in the GINA UI endpoint. If immediate patching is not feasible, implement network segmentation to restrict access to the GINA UI administrative interface to trusted management networks only (typically port 443/8443). Consider disabling or restricting access to the vulnerable GINA UI endpoint entirely if not actively used, though this may impact administrative functionality. Review and minimize enabled template plugins to reduce attack surface, particularly plugins that provide system-level access or code execution capabilities, though this may limit intended functionality. Application-layer firewall rules blocking common SSTI payloads (template expression syntax like ${}, #{}, {{}} depending on the underlying engine) can provide defense-in-depth but may be bypassed through encoding or alternate syntax and could break legitimate template usage.
Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. Rated c
Invision Community 5.0.0 through 5.0.6 contains an unauthenticated remote code execution vulnerability in the template e
Remote code execution in the WPML WordPress multilingual plugin (versions up to and including 4.6.12) allows Contributor
Server-side template injection in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source allows remote unauthentica
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Rated critical seve
changedetection.io is an open source web page change detection, website watcher, restock monitor and notification servic
A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms all
Remote code execution in WGDashboard 4.3.2 and earlier lets authenticated attackers inject Server-Side Template Injectio
Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to Re
Server-side template injection in the TYPO3 'Powermail' extension lets an anonymous user submit Fluid template syntax th
Code injection in Orval before 8.21.0 lets an attacker-controlled OpenAPI v3 or Swagger v2 specification execute arbitra
Server-side template injection in FOSSBilling versions prior to 0.8.0 allows authenticated administrators to execute arb
Share
External POC / Exploit Code
Leaving vuln.today