CVE-2026-54390
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk25th percentile — higher than 25% of all known CVEs
Summary
JTL Shop versions 5.2.0 through 5.7.1 contain a server-side template injection vulnerability that allows unauthenticated attackers to inject malicious template syntax due to unsanitized user-supplied input passed to the Smarty template engine.
Risk Assessment
Attackers can exploit this flaw to read sensitive server-side values such as database credentials and encryption keys, and on versions 5.4.0 through 5.7.1, leverage registered Smarty modifiers including unserialize and file_get_contents to write a webshell to the web root and execute arbitrary commands as the web server user.
Recommendation
It is recommended to update JTL Shop to the latest version to mitigate this vulnerability and implement appropriate input sanitization mechanisms.
Original NVD description (English source)
JTL Shop versions 5.2.0 through 5.7.1 contains a server-side template injection vulnerability that allows unauthenticated attackers to inject malicious template syntax due to unsanitized user-supplied input passed to the Smarty template engine. Attackers can exploit this flaw to read sensitive server-side values such as database credentials and encryption keys, and on versions 5.4.0 through 5.7.1, leverage registered Smarty modifiers including unserialize and file_get_contents to write a webshell to the web root and execute arbitrary commands as the web server user.