CVE-2026-103904 Details
Description
The public consent endpoint of JTL-Shop accepts arbitrary consent names from unauthenticated visitors without validating them against the configured consent items. These names are stored in the consent statistics and rendered without output encoding in the administration backend. An unauthenticated remote attacker can thereby inject script code that is executed in the browser session of an administrator viewing the consent statistics page, allowing actions to be performed with the administrator's privileges.
A stored cross-site scripting vulnerability has been identified in JTL-Shop versions 5.4.0 prior to 5.6.5, 5.7.0 prior to 5.7.5, and 5.8.0 prior to 5.8.2. The issue arises in the public consent endpoint, which accepts arbitrary consent names from unauthenticated users without proper validation against configured consent items. These names are saved in the consent statistics and displayed without output encoding in the administration backend. This allows an unauthenticated remote attacker to inject script code that is executed in the browser of an administrator viewing the consent statistics, potentially leading to actions being performed with the administrator's privileges.
Users should update to JTL-Shop versions 5.6.5, 5.7.5, or 5.8.2. For those unable to update, patch files are available. After updating, it is recommended to check the Consent-Statistics for any suspicious entries and delete them.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.jtl-software.com/de/security/sicherheitsluecke-shop-xss/ | ENISA | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | ENISA |
Affected Products
| Product | Versions |
|---|---|
| JTL-Shop | >= 5.4.0, <= 5.6.4 (semver) >= 5.7.0, <= 5.7.4 (semver) >= 5.8.0, <= 5.8.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | ENISA |