Symlink Cache Exposure in AWS SAM CLI <1.134.0
CVE-2025-3048 Published on March 31, 2025
Path Traversal in AWS SAM CLI allows file copy to local cache
After completing a build with AWS Serverless Application Model Command Line Interface (SAM CLI) which include symlinks, the content of those symlinks are copied to the cache of the local workspace as regular files or directories. As a result, a user who does not have access to those symlinks outside of the Docker container would now have access via the local workspace.
Users should upgrade to version 1.134.0 and ensure any forked or derivative code is patched to incorporate the new fixes. After upgrading, users must re-build their applications using the sam build --use-container to update the symlinks.
Vulnerability Analysis
CVE-2025-3048 is exploitable with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.
Weakness Type
What is a Symlink following Vulnerability?
The software, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the software to operate on unauthorized files. A software system that allows UNIX symbolic links (symlink) as part of paths whether in internal code or through user input can allow an attacker to spoof the symbolic link and traverse the file system to unintended locations or access arbitrary files. The symbolic link can permit an attacker to read/write/corrupt a file that they originally did not have permissions to access.
CVE-2025-3048 has been classified to as a Symlink following vulnerability or weakness.
Products Associated with CVE-2025-3048
Want to know whenever a new CVE is published for Amazon Aws? stack.watch will email you.
Affected Versions
AWS Serverless Application Model Command Line Interface:- Version 1.9.0 and below 1.134.0 is affected.
Vulnerable Packages
The following package name and versions may be associated with CVE-2025-3048
| Package Manager | Vulnerable Package | Versions | Fixed In |
|---|---|---|---|
| pip | aws-sam-cli | < 1.134.0 | 1.134.0 |
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.