Read the docs
TI-2026-39268 Aliases CVE-2026-54390GHSA-pxq6-fr5m-fwh5

JTL Shop < 5.7.2 Server-Side Template Injection via Smarty Renderer

Priority MEDIUM 49CWE-1336Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-1336.

Summary

JTL Shop versions 5.2.0 through 5.7.1 contains a server-side template injection vulnerability that allows unauthenticated attackers to inject malicious template syntax due to unsanitized user-supplied input passed to the Smarty template engine. Attackers can exploit this flaw to read sensitive server-side values such as database credentials and encryption keys, and on versions 5.4.0 through 5.7.1, leverage registered Smarty modifiers including unserialize and file_get_contents to write a webshell to the web root and execute arbitrary commands as the web server user.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00604 49th percentileScored 2026-11-07
Fix Fixed JTL Shop (JTL Software): 5.0.0, 5.5.4, 5.6.2 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
JTL-Software GmbHJTL Shop5.2.0 to before 5.4.0; 5.4.0 to before 5.5.4; 5.6.0 to before 5.6.2; 5.7.0 to before 5.7.25.0.0, 5.5.4, 5.6.2, 5.7.2Patch availableCNA
  • JTL Shop VendorJTL-Software GmbH Affected 5.2.0 to before 5.4.0; 5.4.0 to before 5.5.4; 5.6.0 to before 5.6.2; 5.7.0 to before 5.7.2 Fixed in 5.0.0, 5.5.4, 5.6.2, 5.7.2 Patch available CNA

Remediation

  • Fix · CNA JTL Shop (JTL Software) Fixed in 5.0.0, 5.5.4, 5.6.2, 5.7.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54390
  2. 2026-10-03 Alias added: GHSA-pxq6-fr5m-fwh5
  3. 2026-10-29 Affected versions changed · CNA

References

Patch 1

Other 1

  • TI-2026-73907 Unauthenticated plugin safe mode toggle in JTL-Shop enables denial of service CVSS 4.0HIGH 8.7
  • TI-2026-73906 Stored cross-site scripting in JTL-Shop consent statistics CVSS 4.0HIGH 8.6
  • TI-2010-00659 SQL injection vulnerability in druckansicht.php in JTL-Shop 2 allows remote attackers to… CVSS 2.0HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences