Server-Side Template Injection Vulnerability in JTL Shop by JTL Software

CVE-2026-54390

What is CVE-2026-54390?

Versions 5.2.0 through 5.7.1 of JTL Shop contain a vulnerability that permits unauthenticated attackers to exploit unsanitized user input processed by the Smarty template engine. This flaw enables attackers to inject malicious template syntax, potentially compromising server-side values such as database credentials and encryption keys. Notably, on versions 5.4.0 through 5.7.1, the vulnerability allows malicious actors to leverage registered Smarty modifiers to write a webshell into the web root and execute arbitrary commands under the privileges of the web server user.

References