Which versions of JTL Shop are affected by CVE-2026-54390?

JTL Shop versions 5.2.0 through 5.7.1 contain a critical vulnerability allowing unauthenticated remote access to sensitive credentials and encryption keys.. A patch is available.

How to fix or mitigate CVE-2026-54390?

Within 24 hours: Identify all JTL Shop deployments and confirm installed versions against the affected range (5.2.0-5.7.1); isolate any confirmed vulnerable instances from network access if immediate patching is not possible. Within 7 days: Apply the vendor-released patch for CVE-2026-54390 to all affected JTL Shop instances; consult the official JTL vendor advisory for the specific patched version number. Within 30 days: Review affected systems for signs of prior exploitation (template injection payloads in logs, unexpected webshells, suspicious process execution); rotate all system credentials and database passwords as a precautionary measure.

JTL Shop CVE-2026-54390

Q: What is the CVSS score of CVE-2026-54390?

CVE-2026-54390 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-37925 CRITICAL

Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

2026-06-18 VulnCheck

GHSA-pxq6-fr5m-fwh5

Ssti Deserialization Jtl Shop

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Remote unauthenticated HTTP request with no user interaction yields SSTI and RCE as the web user, giving full C/I/A impact on the vulnerable host without scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 18, 2026 - 18:01 vuln.today

DescriptionCVE.org

JTL Shop versions 5.2.0 through 5.7.1 contains a server-side template injection vulnerability that allows unauthenticated attackers to inject malicious template syntax due to unsanitized user-supplied input passed to the Smarty template engine. Attackers can exploit this flaw to read sensitive server-side values such as database credentials and encryption keys, and on versions 5.4.0 through 5.7.1, leverage registered Smarty modifiers including unserialize and file_get_contents to write a webshell to the web root and execute arbitrary commands as the web server user.

AnalysisAI

Server-side template injection in JTL Shop 5.2.0 through 5.7.1 allows remote unauthenticated attackers to inject Smarty template syntax via unsanitized user input, exposing sensitive server-side values like database credentials and encryption keys. On versions 5.4.0 through 5.7.1, the flaw escalates to remote code execution by abusing registered Smarty modifiers (unserialize, file_get_contents) to drop a webshell and execute commands as the web server user. Publicly available exploit code exists via the Sansec research writeup, though no public exploit identified at time of analysis in CISA KEV.

Technical ContextAI

JTL Shop is a German PHP-based e-commerce platform (cpe:2.3:a:jtl_software:jtl_shop) that uses the Smarty template engine for rendering storefront views. The root cause is CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine): user-supplied input is concatenated into Smarty templates without escaping or sandboxing, so attacker-controlled strings are parsed as template code rather than data. Because Smarty exposes registered PHP modifiers like unserialize and file_get_contents, SSTI in this context bridges directly to PHP object injection and arbitrary filesystem reads - the classic deserialization-to-RCE pivot called out in the tags.

RemediationAI

Vendor-released patch: upgrade to JTL Shop 5.7.2 or later as announced in the JTL forum thread at https://forum.jtl-software.de/threads/jtl-shop-5-7-aktuell-5-7-2.246278/, which addresses the unsanitized input passed to the Smarty renderer. If immediate upgrade is not possible, deploy a WAF rule to block Smarty syntax tokens such as {$, {literal}, and registered modifier names (unserialize, file_get_contents) in HTTP parameters reaching shop endpoints - note this is brittle and may break legitimate content containing curly braces. As compensating controls, restrict write permissions on the web root so the PHP-FPM/Apache user cannot drop files (breaks plugin install flows), rotate any database credentials and encryption keys that may have been exposed prior to patching, and review web server access logs against the indicators in the Sansec research at https://sansec.io/research/jtl-shop-ssti-rce.