The vulnerability is a Server‑Side Template Injection that allows an unauthenticated attacker to inject and execute arbitrary template expressions through the redirectToUrl endpoint and the redirectUrlParameter. This flaw permits the attacker to run server‑side code and achieve full remote control, including establishing a reverse shell. The weakness is an input validation defect pointed to by CWE‑1336.

Affected versions are all releases of Wirtualna Uczelnia from Simple SA up to wu#2016.437.295#0#20260327_105545. No other vendor or product versions are listed.

With a CVSS score of 9.3 the flaw is classified as critical; the EPSS score is unavailable, so current exploitation probability is unknown, and the vulnerability is not in the CISA KEV catalog. An attacker can exploit the flaw without authentication, making it highly attractive. The lack of a published exploit does not reduce the risk, as the underlying mechanics are trivial to craft given the surface exposed by the unvalidated redirectUrlParameter.