---
id: CVE-2026-54390
title: JTL Shop < 5.7.2 Server-Side Template Injection via Smarty Renderer
summary: >-
  JTL Shop versions 5.2.0 through 5.7.1 contains a server-side template
  injection vulnerability that allows unauthenticated attackers to inject
  malicious template syntax due to unsanitized user-supplied input passed to the
  Smarty template …
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-1336
vendor: JTL Software
product: JTL Shop
affected:
  - jtl_shop >= 5.2.0 < 5.4.0
  - jtl_shop >= 5.4.0 < 5.5.4
  - jtl_shop >= 5.6.0 < 5.6.2
  - jtl_shop >= 5.7.0 < 5.7.2
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-06-22T12:39:02.156506Z'
exploitAvailable: true
published: '2026-06-18'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T21:15:43.423Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-54390'
references:
  - url: 'https://sansec.io/research/jtl-shop-ssti-rce'
  - url: 'https://forum.jtl-software.de/threads/jtl-shop-5-7-aktuell-5-7-2.246278/'
  - url: >-
      https://www.vulncheck.com/advisories/jtl-shop-server-side-template-injection-via-smarty-renderer
tags:
  - cve.org
  - exploit-available
epss: 0.00604
epssPercentile: 0.49016
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/shinthink/CVE-2026-54390'
  checkedAt: '2026-11-05T15:44:43.481Z'
ingestedAt: '2026-11-03T08:39:35.553Z'
---

## Overview

JTL Shop versions 5.2.0 through 5.7.1 contains a server-side template injection vulnerability that allows unauthenticated attackers to inject malicious template syntax due to unsanitized user-supplied input passed to the Smarty template engine. Attackers can exploit this flaw to read sensitive server-side values such as database credentials and encryption keys, and on versions 5.4.0 through 5.7.1, leverage registered Smarty modifiers including unserialize and file_get_contents to write a webshell to the web root and execute arbitrary commands as the web server user.

## Affected

- `jtl_shop >= 5.2.0 < 5.4.0`
- `jtl_shop >= 5.4.0 < 5.5.4`
- `jtl_shop >= 5.6.0 < 5.6.2`
- `jtl_shop >= 5.7.0 < 5.7.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.