A weakness has been identified in Dromara Sa-Token up to 1.44.0. This affects the function ObjectInputStream.readObject of the file SaJdkSerializer.java. Executing manipulation can lead to deserialization. The attack may be launched remotely. This attack is characterized by high complexity. It is indicated that the exploitability is difficult. The vendor was contacted early about this disclosure but did not respond in any way.
PUBLISHED5.2CWE-502CWE-20
Dromara Sa-Token SaJdkSerializer.java ObjectInputStream.readObject deserialization
Problem type
Affected products
Dromara
Sa-Token
1.0 - AFFECTED
1.1 - AFFECTED
1.2 - AFFECTED
1.3 - AFFECTED
1.4 - AFFECTED
1.5 - AFFECTED
1.6 - AFFECTED
1.7 - AFFECTED
1.8 - AFFECTED
1.9 - AFFECTED
1.10 - AFFECTED
1.11 - AFFECTED
1.12 - AFFECTED
1.13 - AFFECTED
1.14 - AFFECTED
1.15 - AFFECTED
1.16 - AFFECTED
1.17 - AFFECTED
1.18 - AFFECTED
1.19 - AFFECTED
1.20 - AFFECTED
1.21 - AFFECTED
1.22 - AFFECTED
1.23 - AFFECTED
1.24 - AFFECTED
1.25 - AFFECTED
1.26 - AFFECTED
1.27 - AFFECTED
1.28 - AFFECTED
1.29 - AFFECTED
1.30 - AFFECTED
1.31 - AFFECTED
1.32 - AFFECTED
1.33 - AFFECTED
1.34 - AFFECTED
1.35 - AFFECTED
1.36 - AFFECTED
1.37 - AFFECTED
1.38 - AFFECTED
1.39 - AFFECTED
1.40 - AFFECTED
1.41 - AFFECTED
1.42 - AFFECTED
1.43 - AFFECTED
1.44.0 - AFFECTED
References
VDB-338495 | Dromara Sa-Token SaJdkSerializer.java ObjectInputStream.readObject deserialization
https://vuldb.com/?id.338495
VDB-338495 | CTI Indicators (IOB, IOC, IOA)
https://vuldb.com/?ctiid.338495
Submit #711750 | github.com/dromara/Sa-Token Sa-Token <=1.44.0 Deserialization
https://vuldb.com/?submit.711750
github.com
https://github.com/Yohane-Mashiro/Sa-Token-cve
GitHub Security Advisories
GHSA-9786-pc79-p3v7
A weakness has been identified in Dromara Sa-Token up to 1.44.0. This affects the function...
https://github.com/advisories/GHSA-9786-pc79-p3v7A weakness has been identified in Dromara Sa-Token up to 1.44.0. This affects the function ObjectInputStream.readObject of the file SaJdkSerializer.java. Executing manipulation can lead to deserialization. The attack may be launched remotely. This attack is characterized by high complexity. It is indicated that the exploitability is difficult. The vendor was contacted early about this disclosure but did not respond in any way.
JSON source
https://cveawg.mitre.org/api/cve/CVE-2025-15117Click to expand
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2025-15117",
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"dateUpdated": "2025-12-28T02:32:05.652Z",
"dateReserved": "2025-12-27T08:45:42.246Z",
"datePublished": "2025-12-28T02:32:05.652Z",
"state": "PUBLISHED"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB",
"dateUpdated": "2025-12-28T02:32:05.652Z"
},
"title": "Dromara Sa-Token SaJdkSerializer.java ObjectInputStream.readObject deserialization",
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in Dromara Sa-Token up to 1.44.0. This affects the function ObjectInputStream.readObject of the file SaJdkSerializer.java. Executing manipulation can lead to deserialization. The attack may be launched remotely. This attack is characterized by high complexity. It is indicated that the exploitability is difficult. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"affected": [
{
"vendor": "Dromara",
"product": "Sa-Token",
"versions": [
{
"version": "1.0",
"status": "affected"
},
{
"version": "1.1",
"status": "affected"
},
{
"version": "1.2",
"status": "affected"
},
{
"version": "1.3",
"status": "affected"
},
{
"version": "1.4",
"status": "affected"
},
{
"version": "1.5",
"status": "affected"
},
{
"version": "1.6",
"status": "affected"
},
{
"version": "1.7",
"status": "affected"
},
{
"version": "1.8",
"status": "affected"
},
{
"version": "1.9",
"status": "affected"
},
{
"version": "1.10",
"status": "affected"
},
{
"version": "1.11",
"status": "affected"
},
{
"version": "1.12",
"status": "affected"
},
{
"version": "1.13",
"status": "affected"
},
{
"version": "1.14",
"status": "affected"
},
{
"version": "1.15",
"status": "affected"
},
{
"version": "1.16",
"status": "affected"
},
{
"version": "1.17",
"status": "affected"
},
{
"version": "1.18",
"status": "affected"
},
{
"version": "1.19",
"status": "affected"
},
{
"version": "1.20",
"status": "affected"
},
{
"version": "1.21",
"status": "affected"
},
{
"version": "1.22",
"status": "affected"
},
{
"version": "1.23",
"status": "affected"
},
{
"version": "1.24",
"status": "affected"
},
{
"version": "1.25",
"status": "affected"
},
{
"version": "1.26",
"status": "affected"
},
{
"version": "1.27",
"status": "affected"
},
{
"version": "1.28",
"status": "affected"
},
{
"version": "1.29",
"status": "affected"
},
{
"version": "1.30",
"status": "affected"
},
{
"version": "1.31",
"status": "affected"
},
{
"version": "1.32",
"status": "affected"
},
{
"version": "1.33",
"status": "affected"
},
{
"version": "1.34",
"status": "affected"
},
{
"version": "1.35",
"status": "affected"
},
{
"version": "1.36",
"status": "affected"
},
{
"version": "1.37",
"status": "affected"
},
{
"version": "1.38",
"status": "affected"
},
{
"version": "1.39",
"status": "affected"
},
{
"version": "1.40",
"status": "affected"
},
{
"version": "1.41",
"status": "affected"
},
{
"version": "1.42",
"status": "affected"
},
{
"version": "1.43",
"status": "affected"
},
{
"version": "1.44.0",
"status": "affected"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "Deserialization",
"cweId": "CWE-502",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"lang": "en",
"description": "Improper Input Validation",
"cweId": "CWE-20",
"type": "CWE"
}
]
}
],
"references": [
{
"url": "https://vuldb.com/?id.338495",
"name": "VDB-338495 | Dromara Sa-Token SaJdkSerializer.java ObjectInputStream.readObject deserialization",
"tags": [
"vdb-entry",
"technical-description"
]
},
{
"url": "https://vuldb.com/?ctiid.338495",
"name": "VDB-338495 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
]
},
{
"url": "https://vuldb.com/?submit.711750",
"name": "Submit #711750 | github.com/dromara/Sa-Token Sa-Token <=1.44.0 Deserialization",
"tags": [
"third-party-advisory"
]
},
{
"url": "https://github.com/Yohane-Mashiro/Sa-Token-cve",
"tags": [
"related"
]
}
],
"metrics": [
{},
{
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:R",
"baseScore": 3.1,
"baseSeverity": "LOW"
}
},
{
"cvssV3_0": {
"version": "3.0",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:R",
"baseScore": 3.1,
"baseSeverity": "LOW"
}
},
{
"cvssV2_0": {
"version": "2.0",
"vectorString": "AV:N/AC:H/Au:S/C:N/I:N/A:P/E:ND/RL:ND/RC:UR",
"baseScore": 2.1
}
}
],
"timeline": [
{
"time": "2025-12-27T00:00:00.000Z",
"lang": "en",
"value": "Advisory disclosed"
},
{
"time": "2025-12-27T01:00:00.000Z",
"lang": "en",
"value": "VulDB entry created"
},
{
"time": "2025-12-27T09:50:51.000Z",
"lang": "en",
"value": "VulDB entry last update"
}
]
}
}
}