Amazon AWS Serverless Application Model Command Line Interface SAM CLI path traversal

Summaryinfo

A vulnerability was found in Amazon AWS Serverless Application Model Command Line Interface up to 1.133.x and classified as critical. This affects an unknown part of the component SAM CLI. Executing a manipulation can lead to path traversal. The identification of this vulnerability is CVE-2025-3048. The attack may be launched remotely. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in Amazon AWS Serverless Application Model Command Line Interface up to 1.133.x. This vulnerability affects an unknown code of the component SAM CLI. The manipulation with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. As an impact it is known to affect confidentiality. CVE summarizes:

After completing a build with AWS Serverless Application Model Command Line Interface (SAM CLI) which include symlinks, the content of those symlinks are copied to the cache of the local workspace as regular files or directories. As a result, a user who does not have access to those symlinks outside of the Docker container would now have access via the local workspace. Users should upgrade to version 1.134.0 and ensure any forked or derivative code is patched to incorporate the new fixes. After upgrading, users must re-build their applications using the sam build --use-container to update the symlinks.

The advisory is available at aws.amazon.com. This vulnerability was named CVE-2025-3048 since 03/31/2025. The exploitation appears to be easy. The attack can be initiated remotely. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1006 by the MITRE ATT&CK project.

The vulnerability scanner Nessus provides a plugin with the ID 233868 (AWS SAM CLI < 1.133.0 multiple vulnerabilities), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.134.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (233868). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Amazon

Name

• AWS Serverless Application Model Command Line Interface

Version

• 1.133

License

• commercial

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion