Deserialization Vulnerability in Dromara Sa-Token by Dromara
CVE-2025-15222

2.3LOW

Key Information:

Vendor: Dromara
Status: Sa-token
Vendor: CVE Published:; 30 December 2025

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2025-15222?

A vulnerability exists in Dromara Sa-Token versions up to 1.44.0, specifically affecting the ObjectInputStream.readObject function in SaSerializerTemplateForJdkUseBase64.java. This flaw allows for remote deserialization attacks that can be leveraged by threat actors. Due to the vulnerable nature of the affected code, an attacker could manipulate serialized objects leading to potential unauthorized actions. The complexity of exploiting this vulnerability is assessed to be high, requiring significant effort from the attacker. It is noteworthy that the exploit for this vulnerability has been made public and appropriate measures should be taken to ensure system security.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Sa-Token 1.0

Sa-Token 1.1

Sa-Token 1.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2025-15222 - Proof of Concept