CVE-2025-3048— Path Traversal in AWS SAM CLI allows file copy to local cache
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-3048
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Path Traversal in AWS SAM CLI allows file copy to local cache
Source: NVD (National Vulnerability Database)
Vulnerability Description
After completing a build with AWS Serverless Application Model Command Line Interface (SAM CLI) which include symlinks, the content of those symlinks are copied to the cache of the local workspace as regular files or directories. As a result, a user who does not have access to those symlinks outside of the Docker container would now have access via the local workspace. Users should upgrade to version 1.134.0 and ensure any forked or derivative code is patched to incorporate the new fixes. After upgrading, users must re-build their applications using the sam build --use-container to update the symlinks.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
CWE-61
Source: NVD (National Vulnerability Database)
Vulnerability Title
AWS SAM CLI 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
AWS SAM CLI是Amazon Web Services开源的一个使用 AWS SAM 构建、测试、调试和部署无服务器应用程序的 CLI 工具。 AWS SAM CLI存在安全漏洞，该漏洞源于符号链接内容可能被复制到本地工作区缓存。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| AWS | AWS Serverless Application Model Command Line Interface | 1.9.0 ~ 1.134.0 | - |
II. Public POCs for CVE-2025-3048
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-3048
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same vendor: AWS
- CVE-2026-7461
OS Command Injection in Amazon ECS Agent via FSx Windows Fil - CVE-2026-7426
Out-of-Bounds Write via Unsanitized Prefix Length in Router - CVE-2026-7425
Out-of-Bounds Read in Router Advertisement Option Parser in - CVE-2026-7424
Integer Underflow in DHCPv6 Sub-Option Parser in FreeRTOS-Pl - CVE-2026-7423
Integer Underflow in ICMP Echo Reply Processing in FreeRTOS-
Same weakness: CWE-61
- CVE-2026-29203
cPanel 安全漏洞 - CVE-2026-42275
zrok: WebDAV drive backend follows symlinks outside DriveRoo - CVE-2026-31893
Tunnelblick arbitrary file read via symlink following in tun - CVE-2026-7832
IObit Advanced SystemCare Service ASC.exe symlink - CVE-2026-43570
OpenClaw 2026.3.22 < 2026.4.5 - Symlink Traversal in Remote
V. Comments for CVE-2025-3048
No comments yet