CVE-2026-54390: JTL Shop < 5.7.2 Server-Side Template Injection via Smarty Renderer
JTL Shop versions 5.2.0 through 5.7.1 contains a server-side template injection vulnerability that allows unauthenticated attackers to inject malicious template syntax due to unsanitized user-supplied input passed to the Smarty template engine. Attackers can exploit this flaw to read sensitive server-side values such as database credentials and encryption keys, and on versions 5.4.0 through 5.7.1, leverage registered Smarty modifiers including unserialize and filegetcontents to write a webshell to the web root and execute arbitrary commands as the web server user.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
JTL Shopto a version that resolves this vulnerability.Fixed in 5.7.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54390?
CVE-2026-54390 has a critical severity rating of 9.8.
How do I fix CVE-2026-54390?
To fix CVE-2026-54390, upgrade JTL Shop to version 5.7.2 or later.
What impact does CVE-2026-54390 have on JTL Shop?
CVE-2026-54390 allows unauthenticated attackers to exploit server-side template injection to access sensitive data.
Which versions of JTL Shop are affected by CVE-2026-54390?
JTL Shop versions 5.2.0 through 5.7.1 are affected by CVE-2026-54390.
Can CVE-2026-54390 be exploited remotely?
Yes, CVE-2026-54390 can be exploited remotely by unauthenticated attackers.