The vulnerability is a server‑side template injection in GBIF Integrated Publishing Toolkit. An authenticated user can supply arbitrary template fragments that the engine processes, allowing unauthorized reading of server‑side files and runtime data. While the injected payload is executed by the template engine, the CVE does not explicitly confirm code execution; however, the nature of the flaw suggests that arbitrary code execution could be possible if an attacker can craft a malicious template. This weakness belongs to CWE‑1336.

GBIF Integrated Publishing Toolkit versions prior to 3.3.4 are affected. No other vendors or products were listed. Versions 3.3.4 and later contain the fix.

The CVSS score of 7.6 indicates a high‑severity flaw. EPSS data is unavailable and the vulnerability is not listed in CISA KEV, suggesting it is not actively exploited yet. The flaw requires only an authenticated session, so any user with legitimate access could supply a malicious template. The risk is moderate to high, especially where template rendering is exposed to users without strict input validation. Potential of arbitrary code execution remains inferred but not confirmed.