The filter is the first stage of the application, the exploit path is built on an authentication form. If you create a user who already exists, the subsequent messages are passed through the app to an SSTI-vulnerable application.
For example, if you create the first user as {{'7'*7}}@example.com
, nothing happens. If you then resend a user creation request with the same email, you get a message saying 77777@example.com already exists.
What this means is that the first creation has to work, which means it has to get through the filtering in place on that stage - this largely excludes anything I’ve tried .