CVE-2026-103904 JTL-Software GmbH CVE debrief

Who should care

Defenders responsible for JTL-Shop installations, especially those using versions 5.4.0 to 5.6.5, 5.7.0 to 5.7.5, and 5.8.0 to 5.8.2, should assess exposure and prioritize patching or applying workarounds.

Why it matters

The stored XSS vulnerability in JTL-Shop allows an unauthenticated remote attacker to inject script code that can be executed in the browser session of an administrator, potentially leading to actions being performed with the administrator's privileges. Defenders should prioritize verifying exposure and applying patches or workarounds.

• An unauthenticated remote attacker can inject script code that is executed in the browser session of an administrator viewing the consent statistics page.
• The injected script code can allow actions to be performed with the administrator's privileges.
• Defenders need to verify exposure of JTL-Shop installations and apply patches or workarounds to prevent exploitation.
• The vulnerability requires verification of affected versions and inventory checks to ensure exposure is properly assessed.

Technical summary

The public consent endpoint of JTL-Shop accepts arbitrary consent names from unauthenticated visitors without validating them against the configured consent items. These names are stored in the consent statistics and rendered without output encoding in the administration backend. An unauthenticated remote attacker can thereby inject script code that is executed in the browser session of an administrator viewing the consent statistics page, allowing actions to be performed with the administrator's privileges.

Defensive priority

Defenders should prioritize verifying exposure of JTL-Shop installations, especially versions 5.4.0 to 5.6.5, 5.7.0 to 5.7.5, and 5.8.0 to 5.8.2, and applying patches or workarounds as recommended by the vendor.

Recommended defensive actions

• Verify JTL-Shop version and check if it is within the affected ranges (5.4.0 to 5.6.5, 5.7.0 to 5.7.5, 5.8.0 to 5.8.2).
• Apply patches or workarounds as recommended by the vendor.
• Monitor for suspicious activity on the consent statistics page.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the stored XSS vulnerability in JTL-Shop, including affected versions and a reference to a vendor advisory. The vulnerability allows an unauthenticated remote attacker to inject script code that is executed in the browser session of an administrator viewing the consent statistics page. The source item provides additional context on the vulnerability, including its impact on JTL-Shop installations. Defenders should verify exposure of JTL-Shop installations and apply patches or workarows

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.