The flaw in MailController::templatePut allows an attacker to inject arbitrary template syntax because the engine fails to neutralize special elements. This missing sanitization constitutes a server‑side template injection weakness (CWE‑1336) that can be abused to execute code on the host. The vendor’s lack of a response further increases the risk for systems still running the vulnerable versions.

All deployments of Naichen ThinkCMF version 8.0.7 and earlier, especially the Email Template module that contains MailController.php. Administrators using the default configuration of the MailController endpoint must be aware that any request to templatePut can be manipulated to inject template payloads.

The CVSS score of 5.1 indicates moderate impact, and the lack of an EPSS score or KEV listing suggests limited public exploitation to date. Nevertheless, the vulnerability can be triggered remotely through crafted POST data to the templatePut API, and successful exploitation may lead to full code execution and compromise of the underlying web server.