{"id":"CVE-2026-54390","title":"JTL Shop < 5.7.2 Server-Side Template Injection via Smarty Renderer","summary":"JTL Shop versions 5.2.0 through 5.7.1 contains a server-side template injection vulnerability that allows unauthenticated attackers to inject malicious template syntax due to unsanitized user-supplied input passed to the Smarty template …","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-1336"],"vendor":"JTL Software","product":"JTL Shop","affected":["jtl_shop >= 5.2.0 < 5.4.0","jtl_shop >= 5.4.0 < 5.5.4","jtl_shop >= 5.6.0 < 5.6.2","jtl_shop >= 5.7.0 < 5.7.2"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-06-22T12:39:02.156506Z"},"exploitAvailable":true,"published":"2026-06-18","updated":"2026-10-29","sourceUpdated":"2026-10-29T21:15:43.423Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-54390","references":[{"url":"https://sansec.io/research/jtl-shop-ssti-rce"},{"url":"https://forum.jtl-software.de/threads/jtl-shop-5-7-aktuell-5-7-2.246278/"},{"url":"https://www.vulncheck.com/advisories/jtl-shop-server-side-template-injection-via-smarty-renderer"}],"tags":["cve.org","exploit-available"],"epss":0.00604,"epssPercentile":0.48894,"exploits":{"github":1,"githubRepos":["https://github.com/shinthink/CVE-2026-54390"],"checkedAt":"2026-11-03T08:40:12.831Z"},"ingestedAt":"2026-11-03T08:39:35.553Z","slug":"CVE-2026-54390","body":"## Overview\n\nJTL Shop versions 5.2.0 through 5.7.1 contains a server-side template injection vulnerability that allows unauthenticated attackers to inject malicious template syntax due to unsanitized user-supplied input passed to the Smarty template engine. Attackers can exploit this flaw to read sensitive server-side values such as database credentials and encryption keys, and on versions 5.4.0 through 5.7.1, leverage registered Smarty modifiers including unserialize and file_get_contents to write a webshell to the web root and execute arbitrary commands as the web server user.\n\n## Affected\n\n- `jtl_shop >= 5.2.0 < 5.4.0`\n- `jtl_shop >= 5.4.0 < 5.5.4`\n- `jtl_shop >= 5.6.0 < 5.6.2`\n- `jtl_shop >= 5.7.0 < 5.7.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"abyssal","depthScore":66,"depthScoreParts":{"impact":53.9,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[]}