CVE-2025-15117

LowCVSS 3.1

Published: 28/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 06/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.32%

23th percentile - higher than 23% of all known CVEs

Summary

A weakness was identified in Dromara Sa-Token up to 1.44.0 affecting the ObjectInputStream.readObject function in SaJdkSerializer.java. Manipulating input can lead to deserialization of untrusted data. The attack may be launched remotely, though it is characterized by high complexity and difficult exploitability.

Risk Assessment

Deserialization of untrusted data could enable remote code execution or other severe impacts. The vendor did not respond to the disclosure, increasing the risk of no timely fix.

Recommendation

Restrict access to the deserialization function, use safe deserialization mechanisms, and monitor the project for an official patch.

Other vulnerabilities in Dromara Sa-Token

CVE-2025-15222Medium
A vulnerability has been found in Dromara Sa-Token up to 1.44.0. This issue affects the function ObjectInputStream.readObject of the file SaSerializerTemplateForJdkUseBase64.java. Such manipulation leads to deserialization. The attack can be executed remotely. This attack is characterized by high complexity. The exploitability is assessed as difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early but did not respond.

Original NVD description (English source)

A weakness has been identified in Dromara Sa-Token up to 1.44.0. This affects the function ObjectInputStream.readObject of the file SaJdkSerializer.java. Executing manipulation can lead to deserialization. The attack may be launched remotely. This attack is characterized by high complexity. It is indicated that the exploitability is difficult. The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS