JTL-Shop: Stored cross-site scripting in consent statistics
Summary
The public consent endpoint of JTL-Shop stores arbitrary consent names without validating them against the configured consent items. The names are displayed unescaped in the backend consent statistics. An unauthenticated attacker can inject script code that runs in the browser of an administrator who opens this page, allowing actions with the administrator's privileges.
Affected
- JTL-Shop 5.4.0 to before 5.6.5
- JTL-Shop 5.7.0 to before 5.7.5
- JTL-Shop 5.8.0 to before 5.8.2
- Versions before 5.4.0: Unknown.
- JTL-hosted shops: not affected according to the vendor.
Fixed in
- Shop 5.6.5 (5.6 line)
- Shop 5.7.5 (5.7 line)
- Shop 5.8.2 (5.8 line)
- Versions 5.4.x and 5.5.x: no patches; manual patch files only for unsupported versions, upgrade to 5.6.5 or later recommended.
Workaround
- Do not open the consent statistics in the backend until the update is applied.
- Check the consent statistics for entries that match no configured consent item and delete suspicious entries. The self-set "accepted_all" entry can be ignored.
- Restrict backend access where possible.
- Note: the update does not remove already injected entries.
Exploitation
- No evidence of exploitation in the wild as of 14 October 2026.
- No public proof of concept known (VulDB: no exploit available).
- CISA SSVC: exploitation none, automatable no, technical impact total.
- Requires an administrator with the statistics view right to open the affected page.
Our recommendation
- Update JTL-Shop to 5.6.5, 5.7.5 or 5.8.2 depending on the installed branch, or upgrade from 5.4.x/5.5.x.
- Review the consent statistics for injected entries and remove them.
- Check whether the shop is internet-facing and not JTL-hosted.
- Patch CVE-2026-103905 and other JTL-Shop issues from the same batch at the same time.
- Ask JTL whether an earlier release partly addressed this issue, as a forum post references the same advisory.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- JTL-Software Sicherheitshinweis www.jtl-software.com
- VulDB CVE-2026-103904 vuldb.com
- Strix CVE-2026-103904 www.strix.ai
- JTL Guide: Statistik Consent-Manager guide.jtl-software.com
- JTL Forum: JTL-Shop 5.7.5 Release forum.jtl-software.de
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:13.
Original description (NVD)
The public consent endpoint of JTL-Shop accepts arbitrary consent names from unauthenticated visitors without validating them against the configured consent items. These names are stored in the consent statistics and rendered without output encoding in the administration backend. An unauthenticated remote attacker can thereby inject script code that is executed in the browser session of an administrator viewing the consent statistics page, allowing actions to be performed with the administrator's privileges.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.