Vulnerability Description
JTL Shop versions 5.2.0 through 5.7.1 contains a server-side template injection vulnerability that allows unauthenticated attackers to inject malicious template syntax due to unsanitized user-supplied input passed to the Smarty template engine. Attackers can exploit this flaw to read sensitive server-side values such as database credentials and encryption keys, and on versions 5.4.0 through 5.7.1, leverage registered Smarty modifiers including unserialize and file_get_contents to write a webshell to the web root and execute arbitrary commands as the web server user.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://forum.jtl-software.de/threads/jtl-shop-5-7-aktuell-5-7-2.246278/
- https://sansec.io/research/jtl-shop-ssti-rce
- https://www.vulncheck.com/advisories/jtl-shop-server-side-template-injection-via
FAQ
What is CVE-2026-54390?
CVE-2026-54390 is a vulnerability with a CVSS score of 9.8 (CRITICAL). JTL Shop versions 5.2.0 through 5.7.1 contains a server-side template injection vulnerability that allows unauthenticated attackers to inject malicious template syntax due to unsanitized user-supplied...
How severe is CVE-2026-54390?
CVE-2026-54390 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-54390?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.