Three of the victims are in a serious condition, while another suffered minor injuries, police spokesman Fabien Hench told Sky News.
Another 14 people are being treated for shock.
The attacker appears to have been a 17-year-old refugee from Afghanistan, Bavaria's interior minister Joachim Herrmann has told German media.
It is understood he made his way to Germany as an unaccompanied minor and had been living in the Bavarian town of Ochsenfurt.
The attack took place between Ochsenfurt and Wuerzburg-Heidingsfeld train stations in Bavaria at around 21.15 local time.
The train was brought to a halt during the attack when one passenger pulled the emergency brake, according to Bavarian radio station BR.
The attacker was then shot dead by police as he tried to flee the scene, Mr Hench confirmed.
The police spokesman declined to comment on media reports that the man attempted to attack police officers before he was shot.
He also would not comment on reports suggesting an Islamist motive.
Police originally reported that 15 people were injured in the attack.
