CVE-2026-54390: JTL Shop < 5.7.2 Server-Side Template Injection via Smarty Renderer

Synopsis

Server-side template injection (SSTI) in JTL Shop affects versions 5.2.0 through 5.7.1, where unsanitized user input is passed directly to the Smarty template engine. The vulnerability is reachable over the network with no authentication required and no user interaction needed. Successful exploitation allows reading sensitive server-side values such as database credentials and encryption keys; on versions 5.4.0 through 5.7.1, attackers can additionally write a webshell to the web root and execute arbitrary commands as the web server user. Patched-image rebuilds at versions 5.0.0, 5.5.4, 5.6.2, and 5.7.2 are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the JTL Shop application over the network; the service must be exposed to the attacker's network segment or the public internet.

• AuthenticationNot required

  No account or session credentials are needed; the injection point is reachable by any unauthenticated HTTP request.

• Victim interactionNot required

  Exploitation is fully attacker-driven and requires no action from any user of the application.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, memory layout dependencies, or special environmental factors need to be satisfied.

Blast Radius

• Reads database credentials and encryption keys stored in server-side configuration accessible to the Smarty rendering context.
• On versions 5.4.0 through 5.7.1, writes an attacker-controlled webshell to the web root directory.
• Executes arbitrary operating system commands as the web server user, giving full control over the application process and its file system access.
• Exfiltrates or tampers with any data the web server user can read or modify, including customer records, order data, and session tokens stored on disk or in the database.