CVE-2025-3048: aws aws serverless application model command line interface UNIX Symbolic Link (Symlink) Following

Vulnerability summary

CVE-2025-3048 is a medium (CVSS 6.9) UNIX Symbolic Link (Symlink) Following vulnerability in aws aws serverless application model command line interface. EPSS estimates a 0.66% chance of exploitation in the next 30 days, higher than 50.5% of scored vulnerabilities.

Timeline

1. 31-03-2025
   PublishedVulnerability first disclosed.
2. 14-10-2025
   Last modifiedVulnerability information updated.

Description

After completing a build with AWS Serverless Application Model Command Line Interface (SAM CLI) which include symlinks, the content of those symlinks are copied to the cache of the local workspace as regular files or directories. As a result, a user who does not have access to those symlinks outside of the Docker container would now have access via the local workspace. Users should upgrade to version 1.134.0 and ensure any forked or derivative code is patched to incorporate the new fixes. After upgrading, users must re-build their applications using the sam build --use-container to update the symlinks.

• CWE-61UNIX Symbolic Link (Symlink) FollowingThe product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.