ThemeREX Classter versions up to 2.5 are affected by a deserialization of untrusted data vulnerability (CVE-2025-54001) that permits object injection. This type of vulnerability arises when untrusted input is deserialized without proper validation, potentially allowing attackers to execute arbitrary code or manipulate application logic. The CVSS 3.1 base score of 9.8 reflects the critical nature of this flaw, with an attack vector over the network, no privileges or user interaction required, and complete compromise of confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and the product is not a cloud service.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary code or manipulate the application, leading to full compromise of the affected system's confidentiality, integrity, and availability. Given the critical CVSS score and the nature of object injection via deserialization, the impact is severe. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting features that involve deserialization of untrusted data if possible. Monitor official ThemeREX communications for updates and apply patches promptly once released.