I recently found a blind FreeMarker SSTI on a bbp. It was not possible to RCE but I found some nice gadgets to enumerate accessible variables, read data blindly or perform some DoS. I documented that here if someone is interested
Nicolas Verdier
@n1nj4sec
Hacker | Bug Bounty Hunter
