CVE-2026-103904: Stored XSS Vulnerability in JTL-Shop
The public consent endpoint of JTL-Shop accepts arbitrary consent names from unauthenticated visitors without validating them against the configured consent items. These names are stored in the consent statistics and rendered without output encoding in the administration backend. An unauthenticated remote attacker can thereby inject script code that is executed in the browser session of an administrator viewing the consent statistics page, allowing actions to be performed with the administrator's privileges.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
JTL-Shop instances where administrators use the consent statistics page are exposed. An attacker can submit malicious consent names through the public consent endpoint, and the payload runs when an administrator views the stored statistics.
Does exploitation require an account or administrator interaction?
The attacker does not need an account or other privileges; the consent endpoint is public. Exploitation does require an administrator to open the consent statistics page containing the injected value.
What can an attacker do after successful exploitation?
The injected script executes in the administrator's browser session. It can perform actions using that administrator's privileges.
How can I tell whether an attempted attack may have occurred?
Review consent statistics for unexpected or suspicious consent names, especially values containing script-like markup or code. Such values may have been submitted through the public consent endpoint and stored for later display in the administration backend.