The vulnerability arises from the SEPPmail Secure Email Gateway GINA UI passing attacker‑controlled input directly to Perl's eval function without validation. This allows anyone who can reach the endpoint to execute arbitrary code, giving attackers full control over the gateway and compromising all email traffic it handles. The flaw is a classic dynamic code injection identified as CWE‑95.

SEPPmail AG Secure Email Gateway versions prior to 15.0.2.1 are affected. The issue exists in the new GINA UI component of the product, and users running versions 15.0 or earlier are vulnerable.

The CVSS score of 9.3 denotes a critical issue. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog, but the lack of authentication means an attacker can trigger the flaw from any network location that can reach the GINA UI endpoint. The risk is high because exploitation yields full remote code execution, making the flaw attractive to attackers. The attack surface is inferred to be a remote network vector based on the description of unauthenticated access.