Deserialization of Untrusted Data vulnerability in ThemeREX Group Travesia travesia allows Object Injection.This issue affects Travesia: from n/a… (CVE-2026-93929)

CVE-2026-93929 is a deserialization of untrusted data vulnerability in ThemeREX Group Travesia travesia that allows object injection attacks. This vulnerability affects versions up to and including 1.1.16. The flaw enables an attacker to send specially crafted serialized data to the application, which when deserialized, can lead to arbitrary code execution or other malicious impacts. The CVSS 3.1 base score is 9.8, reflecting critical impact on confidentiality, integrity, and availability with no required privileges or user interaction and exploitable remotely over the network. No official patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability can result in full compromise of the affected system, including unauthorized disclosure of sensitive information, modification or destruction of data, and disruption of service. The vulnerability is remotely exploitable without authentication or user interaction, making it highly dangerous if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling or restricting access to the affected component to trusted users only and monitor for unusual activity related to deserialization processes.