Authenticated RCE via Zebra template injection

Server-side template injection in OpenBoxes before 0.9.8 allows remote authenticated users to execute arbitrary code via Zebra template rendering. DocumentController.buildZebraTemplate and related print, render, and export actions loaded any document by ID and passed its contents to GroovyPagesTemplateEngine without confirming that the document was a ZEBRA_TEMPLATE, so ${...} expressions in an uploaded document were executed as live Groovy code. Exploitation requires Manager-level access to upload a malicious document and any authenticated user, including the Browser role, to trigger rendering by document ID; successful exploitation yields server-side code execution.