# CVE-2025-3048: Path Traversal in AWS SAM CLI allows file copy to local cache

> CVE-2025-3048: Path Traversal in AWS SAM CLI allows file copy to local cache. CVSS 6.5 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2025-3048
Last updated: 2026-06-17T09:19:05Z

- Published: 2025-03-31 15:21 UTC · Updated: 2026-06-17 09:19 UTC · Assigner: AMZN
- CVSS: 6.5 (CVSS 3.1) · Severity: Medium · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- EPSS: 0.67%, 52th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-61

## Description

After completing a build with AWS Serverless Application Model Command Line Interface (SAM CLI) which include symlinks, the content of those symlinks are copied to the cache of the local workspace as regular files or directories. As a result, a user who does not have access to those symlinks outside of the Docker container would now have access via the local workspace. Users should upgrade to version 1.134.0 and ensure any forked or derivative code is patched to incorporate the new fixes. After upgrading, users must re-build their applications using the sam build --use-container to update the symlinks.

## Affected vendors and products

- AWS: AWS Serverless Application Model Command Line Interface

## Tracked companies

- [Amazon Web Services](https://rewindex.com/company/aws.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2025-3048)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2025-3048)
- [https://aws.amazon.com/security/security-bulletins/AWS-2025-008/](https://aws.amazon.com/security/security-bulletins/AWS-2025-008/)
- [https://github.com/aws/aws-sam-cli/releases/tag/v1.134.0](https://github.com/aws/aws-sam-cli/releases/tag/v1.134.0)
- [https://github.com/aws/aws-sam-cli/security/advisories/GHSA-pp64-wj43-xqcr](https://github.com/aws/aws-sam-cli/security/advisories/GHSA-pp64-wj43-xqcr)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2025-3048 · Markdown: https://rewindex.com/cve/CVE-2025-3048.md · JSON: https://rewindex.com/api/v1/cves/CVE-2025-3048 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:06:20.545Z