CVE-2026-54390

CriticalCVSS 9.8/10Last modified Oct 29, 2026

Description

JTL Shop versions 5.2.0 through 5.7.1 contains a server-side template injection vulnerability that allows unauthenticated attackers to inject malicious template syntax due to unsanitized user-supplied input passed to the Smarty template engine. Attackers can exploit this flaw to read sensitive server-side values such as database credentials and encryption keys, and on versions 5.4.0 through 5.7.1, leverage registered Smarty modifiers including unserialize and file_get_contents to write a webshell to the web root and execute arbitrary commands as the web server user.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1336

Affected software

Vendor	Product	Versions
JTL Software	JTL Shop	>= 5.2.0, < 5.4.0; >= 5.4.0, < 5.5.4; >= 5.6.0, < 5.6.2; >= 5.7.0, < 5.7.2

References

Timeline

Published: Jun 18, 2026
Last modified: Oct 29, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-543935.1A stored cross-site scripting vulnerability exists in MISP when the Overmind theme is used. The setHomePage endpoint previously saved the us CVE-2026-543945.3MISP contains a path traversal vulnerability in OrganisationsController::getOrgLogo. The vulnerable code builds organisation logo file paths CVE-2026-543955.3MISP contains a reflected cross-site scripting vulnerability in the UiBeta event index view. The urlparams value is inserted into an inline CVE-2026-543965.3An information disclosure vulnerability exists in the MISP AuthKey edit functionality. When a validation error occurs during an AuthKey edit CVE-2026-543976.1A vulnerability in MISP’s non-REST event editing path allowed an authenticated user with event edit permissions to manipulate the submitted CVE-2026-543985.3An authorization flaw in MISP’s object add/edit handling allowed an authenticated user with object editing permissions to assign a MISP obje CVE-2026-543997.5Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 a CVE-2026-54407.5A memory exhaustion vulnerability exists in the HTTP server due to unbounded use of the `Content-Length` header. The server allocates memor CVE-2026-544009.1A malicious actor with access to the network and high privileges could exploit an Improper Access Control vulnerability found in UniFi Acces CVE-2026-544018.8A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) to escalate privileges wi CVE-2026-544028.8A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi OS t CVE-2026-544038.6A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices running UniFi OS to bypas