PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-54390 JTL Software CVE debrief

A critical server-side template injection vulnerability exists in JTL Shop versions 5.2.0 through 5.7.1. This flaw allows unauthenticated attackers to inject malicious template syntax due to unsanitized user-supplied input passed to the Smarty template engine. Successful exploitation enables attackers to read sensitive server-side values, such as database credentials and encryption keys. On versions 5.4.0 through 5.7.1, attackers can leverage registered Smarty modifiers, including unserialize and file_get_contents, to write a webshell to the web root and execute arbitrary commands as the web server user. This vulnerability has a CVSS score of 9.3, indicating a critical severity level.

Vendor
JTL Software
Product
JTL Shop
CVSS
CRITICAL 9.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-18
Original CVE updated
2026-06-23
Advisory published
2026-06-18
Advisory updated
2026-06-23

Who should care

Administrators and security teams responsible for JTL Shop installations, particularly those using versions 5.2.0 through 5.7.1, should be aware of this vulnerability. Due to the critical severity and potential for unauthorized access and command execution, immediate attention is required to mitigate this risk.

Technical summary

The vulnerability is caused by the lack of sanitization of user-supplied input passed to the Smarty template engine in JTL Shop. This allows attackers to inject malicious template syntax, potentially leading to sensitive information disclosure and arbitrary command execution. The vulnerability affects JTL Shop versions 5.2.0 through 5.7.1. Attackers can exploit this flaw by injecting malicious template syntax, which can be used to read sensitive server-side values or, in versions 5.4.0 through 5.7.1, write a webshell to the web root for arbitrary command execution.

Defensive priority

Critical

Recommended defensive actions

  • Immediately upgrade to a patched version of JTL Shop, if available.
  • Implement input validation and sanitization for user-supplied data passed to the Smarty template engine.
  • Restrict access to sensitive server-side values and encryption keys.
  • Monitor JTL Shop installations for suspicious activity, particularly attempts to inject malicious template syntax.
  • Consider implementing a web application firewall (WAF) to detect and prevent template injection attacks.
  • Regularly review and update Smarty template engine configurations to ensure secure settings.

Evidence notes

The information provided is based on the CVE-2026-54390 record and related sources. The vulnerability details and impact are derived from the CVE description and CVSS score. The accuracy of this information relies on the provided sources, including the CVE.org record and NVD detail.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-54390 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-54390

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-54390 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-54390

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.