CVE-2026-54390 is a critical server-side template injection vulnerability affecting JTL Software's JTL Shop product in versions 5.2.0 through 5.7.1. The vulnerability arises from improper neutralization of special elements in user-supplied input passed to the Smarty template engine, allowing unauthenticated attackers to inject malicious template syntax. This can be exploited to read sensitive server-side data including database credentials and encryption keys. Furthermore, in versions 5.4.0 through 5.7.1, attackers can leverage registered Smarty modifiers such as unserialize and file_get_contents to write a webshell to the web root and execute arbitrary commands with the privileges of the web server user. No official patch or remediation level has been provided in the available data.

Successful exploitation allows unauthenticated attackers to disclose sensitive server-side information, including database credentials and encryption keys. On versions 5.4.0 through 5.7.1, attackers can achieve remote code execution by writing a webshell and executing arbitrary commands as the web server user. This represents a critical security risk with potential full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented in the provided data. Until a patch is available, restrict access to vulnerable versions and monitor for suspicious activity related to template injection attempts.