After completing a build with AWS Serverless Application Model Command Line Interface (SAM CLI) which include symlinks, the content of those symlinks are copied to the cache of the local workspace as regular files or directories. As a result, a user who does not have access to those symlinks outside of the Docker container would now have access via the local workspace.

Users should upgrade to version 1.134.0 and ensure any forked or derivative code is patched to incorporate the new fixes. After upgrading, users must re-build their applications using the sam build --use-container to update the symlinks.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Active

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00013.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

No data.

No data.

No data.

No data.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-8753 AWS SAM CLI Path Traversal allows file copy to local cache
Github GHSA Github GHSA GHSA-pp64-wj43-xqcr AWS SAM CLI Path Traversal allows file copy to local cache
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://aws.amazon.com/security/security-bulletins/AWS-2025-008/ cve-icon cve-icon
https://github.com/aws/aws-sam-cli/releases/tag/v1.134.0 cve-icon cve-icon
https://github.com/aws/aws-sam-cli/security/advisories/GHSA-pp64-wj43-xqcr cve-icon cve-icon
History

Tue, 14 Oct 2025 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-22
CWE-497

Tue, 14 Oct 2025 19:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-61

Tue, 14 Oct 2025 18:45:00 +0000

Type Values Removed Values Added
References

Mon, 31 Mar 2025 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 31 Mar 2025 17:00:00 +0000

Type Values Removed Values Added
References

Mon, 31 Mar 2025 15:30:00 +0000

Type Values Removed Values Added
Description After completing a build with AWS Serverless Application Model Command Line Interface (SAM CLI) which include symlinks, the content of those symlinks are copied to the cache of the local workspace as regular files or directories. As a result, a user who does not have access to those symlinks outside of the Docker container would now have access via the local workspace. Users should upgrade to version 1.134.0 and ensure any forked or derivative code is patched to incorporate the new fixes. After upgrading, users must re-build their applications using the sam build --use-container to update the symlinks.
Title Path Traversal in AWS SAM CLI allows file copy to local cache
Weaknesses CWE-22
CWE-497
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: AMZN

Published:

Updated: 2025-10-14T19:23:20.481Z

Reserved: 2025-03-31T13:32:51.607Z

Link: CVE-2025-3048

cve-icon Vulnrichment

Updated: 2025-03-31T16:19:38.897Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-03-31T16:15:27.857

Modified: 2025-10-14T20:15:36.533

Link: CVE-2025-3048

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.