CVE-2026-54390

The flaw

JTL Shop versions 5.2.0 through 5.7.1 contains a server-side template injection vulnerability that allows unauthenticated attackers to inject malicious template syntax due to unsanitized user-supplied input passed to the Smarty template eng

What to do

Review advisory and patch per vendor guidance.

References