CVE-2025-3048

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-3048
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-3048.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-3048
Aliases
Published
2025-03-31T15:21:16.205Z
Modified
2026-07-15T01:49:18.412193326Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Path Traversal in AWS SAM CLI allows file copy to local cache
Details

After completing a build with AWS Serverless Application Model Command Line Interface (SAM CLI) which include symlinks, the content of those symlinks are copied to the cache of the local workspace as regular files or directories. As a result, a user who does not have access to those symlinks outside of the Docker container would now have access via the local workspace.

Users should upgrade to version 1.134.0 and ensure any forked or derivative code is patched to incorporate the new fixes. After upgrading, users must re-build their applications using the sam build --use-container to update the symlinks.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/3xxx/CVE-2025-3048.json",
    "cna_assigner": "AMZN",
    "cwe_ids": [
        "CWE-61"
    ]
}
References

Affected packages

Git / github.com/aws/aws-sam-cli

Affected ranges

Type
GIT
Repo
https://github.com/aws/aws-sam-cli
Events
Introduced
b8a5495bc27c1d9a0edd2e077d72c99d9cad9f56
Fixed
bde031e2421e05183f02f81cf2b8c0a759046b8f
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "1.9.0"
        },
        {
            "fixed": "1.134.0"
        }
    ]
}

Affected versions

v1.*
v1.10.0
v1.100.0
v1.101.0
v1.102.0
v1.103.0
v1.104.0
v1.105.0
v1.106.0
v1.107.0
v1.108.0
v1.109.0
v1.11.0
v1.110.0
v1.111.0
v1.112.0
v1.113.0
v1.114.0
v1.115.0
v1.116.0
v1.117.0
v1.118.0
v1.119.0
v1.12.0
v1.120.0
v1.121.0
v1.122.0
v1.123.0
v1.124.0
v1.125.0
v1.126.0
v1.127.0
v1.128.0
v1.129.0
v1.13.0
v1.13.1
v1.13.2
v1.130.0
v1.131.0
v1.132.0
v1.133.0
v1.14.0
v1.15.0
v1.16.0
v1.17.0
v1.18.0
v1.18.1
v1.18.2
v1.19.0
v1.19.1
v1.20.0
v1.21.0
v1.21.1
v1.22.0
v1.23.0
v1.24.0
v1.24.1
v1.25.0
v1.26.0
v1.27.0
v1.27.1
v1.27.2
v1.28.0
v1.29.0
v1.30.0
v1.31.0
v1.32.0
v1.33.0
v1.34.0
v1.34.1
v1.35.0
v1.36.0
v1.37.0
v1.38.0
v1.38.1
v1.39.0
v1.40.0
v1.40.1
v1.41.0
v1.42.0
v1.43.0
v1.44.0
v1.45.0
v1.46.0
v1.47.0
v1.48.0
v1.49.0
v1.50.0
v1.51.0
v1.52.0
v1.53.0
v1.54.0
v1.55.0
v1.56.0
v1.56.1
v1.57.0
v1.58.0
v1.59.0
v1.60.0
v1.61.0
v1.62.0
v1.63.0
v1.64.0
v1.65.0
v1.66.0
v1.67.0
v1.68.0
v1.69.0
v1.70.0
v1.70.1
v1.71.0
v1.72.0
v1.73.0
v1.74.0
v1.75.0
v1.76.0
v1.77.0
v1.78.0
v1.79.0
v1.80.0
v1.81.0
v1.82.0
v1.83.0
v1.84.0
v1.85.0
v1.86.0
v1.86.1
v1.87.0
v1.88.0
v1.89.0
v1.9.0
v1.90.0
v1.91.0
v1.92.0
v1.93.0
v1.94.0
v1.95.0
v1.96.0
v1.97.0
v1.98.0
v1.99.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-3048.json"