An issue in the FreeMarker Filter of Magnolia CMS v6.2.11 and below allows attackers to bypass security restrictions and execute arbitrary code via a crafted FreeMarker payload.
The vendor's disclosure and fix for this vulnerability can be found here.
More details and the exploitation process can be found in this PDF.
The SSTI gadget used to escape the FreeMarker sandbox was inspired from this article by Vincent Herbulot of Synacktiv