CVE-2025-3047: aws aws serverless application model command line interface UNIX Symbolic Link (Symlink) Following

Vulnerability summary

CVE-2025-3047 is a medium (CVSS 6.9) UNIX Symbolic Link (Symlink) Following vulnerability in aws aws serverless application model command line interface. EPSS estimates a 0.77% chance of exploitation in the next 30 days, higher than 54.7% of scored vulnerabilities.

Timeline

1. 31-03-2025
   PublishedVulnerability first disclosed.
2. 14-10-2025
   Last modifiedVulnerability information updated.

Description

When running the AWS Serverless Application Model Command Line Interface (SAM CLI) build process with Docker and symlinks are included in the build files, the container environment allows a user to access privileged files on the host by leveraging the elevated permissions granted to the tool. A user could leverage the elevated permissions to access restricted files via symlinks and copy them to a more permissive location on the container. Users should upgrade to v1.133.0 or newer and ensure any forked or derivative code is patched to incorporate the new fixes.

• CWE-61UNIX Symbolic Link (Symlink) FollowingThe product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.