CVE-2026-112851: Deserialization of Untrusted Data in ThemeREX Group HotLock

This vulnerability in ThemeREX Group HotLock involves unsafe deserialization of untrusted data, which enables an attacker to perform object injection attacks. The affected versions include all releases from initial up to and including 1.3.9. The vulnerability has a CVSS 3.1 score of 9.8, indicating critical severity with network attack vector, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to execute arbitrary code or commands on the affected system, leading to complete system compromise including data theft, modification, or destruction. The vulnerability poses a critical risk to affected deployments due to its high severity and ease of exploitation.

No patch or official fix information is currently available. Users should monitor the vendor advisory for updates and apply patches once released. In the meantime, restricting network access to the HotLock service and employing application-layer protections against deserialization attacks may reduce exposure.