The flaw lies in the Freemarker template resolver within SmartAdmin’s mail service, where the template_content parameter is not properly neutralized. This can allow a specially crafted template to be processed by the Freemarker engine, leading to server‑side template injection. As a result, the attacker may be able to execute arbitrary FreeMarker expressions during email generation. The vulnerability can be triggered remotely through any input that reaches the template_content argument.

The vulnerability affects SmartAdmin versions up to 3.29 distributed by 1024‑lab and lab1024. The affected component is the MailService.java within the FreeMarker Template Handler module. No public fix or patch has been released, and the vendor has not responded to the disclosure.

The CVSS base score is 5.3, indicating medium severity, and the EPSS probability is below 1 %, showing a low likelihood of widespread exploitation. Nevertheless, an exploit has already been published and can be triggered remotely, so the risk remains present. The vulnerability is not listed in the CISA KEV catalog, but the availability of an exploit in public repositories mandates that organizations assess the threat and implement mitigations.