CVE-2026-54390

CVE-2026-54390 — JTL Shop Smarty SSTI Mass Exploit Pre-Auth Contact Form → Email Subject → fetch'string:' → RCE Overview CVE-2026-54390 is a critical CVSS 9.8 unauthenticated Server-Side Template Injection in JTL Shop 5.2.0–5.7.1. The SmartyRenderer::renderTemplate method passes email subject lin...