What’s Vulnerable › Vulnerabilities

CVE-2025-3047: Path Traversal in AWS SAM CLI allows file copy to build container

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-03-31 · updated 2026-06-17
• Weakness: CWE-61

Description

When running the AWS Serverless Application Model Command Line Interface (SAM CLI) build process with Docker and symlinks are included in the build files, the container environment allows a user to access privileged files on the host by leveraging the elevated permissions granted to the tool. A user could leverage the elevated permissions to access restricted files via symlinks and copy them to a more permissive location on the container. Users should upgrade to v1.133.0 or newer and ensure any forked or derivative code is patched to incorporate the new fixes.

Affected products

• AWS Serverless Application Model Command Line Interface: from 1.98.0 before 1.133.0 — fixed in 1.133.0

How to fix

Upgrade to a fixed version: AWS Serverless Application Model Command Line Interface 1.133.0. Check the vendor advisory for mitigations.

References

• https://aws.amazon.com/security/security-bulletins/AWS-2025-008/
• https://github.com/aws/aws-sam-cli/releases/tag/v1.134.0
• https://github.com/aws/aws-sam-cli/security/advisories/GHSA-px37-jpqx-97q9

Get alerted when CVE-2025-3047 or the next vulnerability affects your stack