SEPPmail Secure Email Gateway Server-Side Template Injection Vulnerability Allowing Remote Code Execution

A server-side template injection vulnerability has been identified in SEPPmail Secure Email Gateway versions prior to 15.0.4. This vulnerability exists in the new GINA user interface, where an endpoint accepts attacker-controlled templates. This flaw allows remote attackers to execute arbitrary template expressions, potentially leading to remote code execution, depending on the enabled template plugins.

Impact

Exploitation of this vulnerability could result in unauthorized execution of code on the server where SEPPmail Secure Email Gateway is running.

Remediation

Users can update to SEPPmail Secure Email Gateway version 15.0.4 or later to address this vulnerability.