The vulnerability is a server‑side template injection in the GINA UI of SEPPmail Secure Email Gateway. An endpoint accepts attacker‑controlled template input, allowing execution of arbitrary template expressions. Depending on the enabled template plugins, an attacker can gain remote code execution, compromising confidentiality, integrity, and availability. This weakness is identified as CWE‑1336.

SEPPmail AG Secure Email Gateway versions prior to 15.0.4 are affected by the server‑side template injection in the GINA UI endpoint.

The CVSS score of 8.3 indicates high severity. No EPSS score is available, and the vulnerability is not listed in CISA's KEV catalog. Likely exploitation requires remote network access to the vulnerable endpoint; the attacker sends crafted requests that trigger template evaluation. The presence of enabled template plugins enables the full remote code execution path, so disabling or restricting plugins reduces risk.