CVE-2026-54390
As of 2026-06-18, CVE-2026-54390 is a CVSS 9.8 (CRITICAL-severity) vulnerability. Threadlinqs Intelligence tracks 0 threats exploiting it.
Last updated: 2026-06-18
JTL Shop versions 5.2.0 through 5.7.1 contains a server-side template injection vulnerability that allows unauthenticated attackers to inject malicious template syntax due to unsanitized user-supplied input passed to the Smarty template engine. Attackers can exploit this flaw to read sensitive server-side values such as database credentials and encryption keys, and on versions 5.4.0 through 5.7.1, leverage registered Smarty modifiers including unserialize and file_get_contents to write a webshell to the web root and execute arbitrary commands as the web server user.
CVSS v3 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses (CWE)
CWE-1336
References
- https://sansec.io/research/jtl-shop-ssti-rce
- https://forum.jtl-software.de/threads/jtl-shop-5-7-aktuell-5-7-2.246278/
- https://www.vulncheck.com/advisories/jtl-shop-server-side-template-injection-via-smarty-renderer
← all vulnerabilities · Markdown version · Threadlinqs Intelligence
Enriched from CVE.org, NVD (this product uses the NVD API but is not endorsed or certified by the NVD), FIRST EPSS, CISA KEV, and GitHub Security Advisories.