PT-2025-53632 · Dromara · Sa-Token

Yohane-Mashiro · Published 2025-12-28 · Updated 2025-12-28 · CVE-2025-15117

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Dromara Sa-Token versions up to 1.44.0

Description A weakness exists in Dromara Sa-Token up to version 1.44.0 related to deserialization. The issue affects the ObjectInputStream.readObject function within the SaJdkSerializer.java file. Exploitation can lead to deserialization and may be launched remotely. The complexity of the attack is high, and exploitability is considered difficult. The vendor was contacted regarding this disclosure but did not respond.

Recommendations Versions prior to 1.44.0 should be used.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

CWE-20

Related Identifiers

CVE-2025-15117

Affected Products

Sa-Token

References · 9

• 🔥 https://github.com/Yohane-Mashiro/Sa-Token-cve · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-15117 · Security Note
• https://vuldb.com/?ctiid.338495 · Note
• https://twitter.com/CVEnew/status/2005117103431446954 · Twitter Post
• https://t.me/cveNotify/146955 · Telegram Post
• https://twitter.com/transilienceai/status/2005119271966212225 · Twitter Post
• https://t.me/CVEtracker/40753 · Telegram Post
• https://vuldb.com/?submit.711750 · Note
• https://vuldb.com/?id.338495 · Note