CVE-2025-3047

MEDIUM

When running the AWS Serverless Application Model Command Line Interface (SAM CLI) build process with Docker and symlinks are included in the build files, the container environment allows a user to...

Affects 0 products across 2 vendors.

CVSS 3.16.5
CVSS v46.9
EPSS0.8%
Percentile55th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, requires user interaction, impact contained to the vulnerable component, full confidentiality impact, no integrity impact, no availability impact.
CWE Weakness Definitions
CWE-61: CWE-61
Related Attack Patterns (CAPEC)
CAPEC-27 Leveraging Race Conditions via Symbolic Links
via CWE-61

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

CVE-2025-3047 affects the AWS Serverless Application Model Command Line Interface (SAM CLI) when using Docker and symlinks, allowing unauthorized access to host files.

BSID: BS-2025-GLOBAL-270185-M • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2025-3047?
CVE-2025-3047 affects the AWS Serverless Application Model Command Line Interface (SAM CLI) when using Docker and symlinks, allowing unauthorized access to host files.
What is the CVSS score for CVE-2025-3047?
CVE-2025-3047 has CVSS 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS: 0.8%.
Is CVE-2025-3047 actively exploited?
No confirmed active exploitation of CVE-2025-3047 as of 2026-05-30.
How do I remediate CVE-2025-3047?
Priority: MEDIUM.
What systems are affected by CVE-2025-3047?
CVE-2025-3047 affects Docker; Serverless.
Vulnerability Details
CVE IDCVE-2025-3047
BSIDBS-2025-GLOBAL-270185-M BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Published2025-03-31
Last Modified2026-04-15
ICS Relevance0%
Weakness (CWE)
CWE-61
Domains
CLOUD
SourceNVD
Official Description

When running the AWS Serverless Application Model Command Line Interface (SAM CLI) build process with Docker and symlinks are included in the build files, the container environment allows a user to access privileged files on the host by leveraging the elevated permissions granted to the tool. A user could leverage the elevated permissions to access restricted files via symlinks and copy them to a more permissive location on the container. Users should upgrade to v1.133.0 or newer and ensure any forked or derivative code is patched to incorporate the new fixes.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker can exploit the elevated permissions granted to SAM CLI during the build process to access and copy restricted files from the host system via symlinks.

Exploitation Likelihood: MEDIUM

Affected Products
VendorProductAffected Versions
Docker — —
Serverless — —
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 563 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceMEDIUM
Enriched At2026-05-24
SHA-512 Audit Hash2ad3f21ceaa38965cfe8f02f9a6cbd3854993747f1251882fe7ea9298c3261e794811b737ea6ddfedde652d9ea1fa1c88833b395bfeefc975dcea868dfe55d99
Related CVEs affecting Docker
CVE-2024-29895 10.0 Cacti provides an operational monitoring and fault management framework. A co... CVE-2014-9357 10.0 Docker 1.3.2 allows remote attackers to execute arbitrary code with root priv... CVE-2026-42869 10.0 SOCFortress CoPilot focuses on providing a single pane of glass for all your ... CVE-2026-40089 9.9 Sonicverse is a Self-hosted Docker Compose stack for live radio streaming. Th... CVE-2026-42454 9.9 Termix is a web-based server management platform with SSH terminal, tunneling...
View all Docker CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →