CVE-2025-3048

MEDIUM

After completing a build with AWS Serverless Application Model Command Line Interface (SAM CLI) which include symlinks, the content of those symlinks are copied to the cache of the local workspace ...

Affects 0 products across 2 vendors.

CVSS 3.16.5
CVSS v46.9
EPSS0.7%
Percentile50th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, requires user interaction, impact contained to the vulnerable component, full confidentiality impact, no integrity impact, no availability impact.
CWE Weakness Definitions
CWE-61: CWE-61
Related Attack Patterns (CAPEC)
CAPEC-27 Leveraging Race Conditions via Symbolic Links
via CWE-61

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

A vulnerability in AWS SAM CLI allows unauthorized access to symlinked content during the build process, as the content is copied to the local workspace cache as regular files or directories.

BSID: BS-2025-GLOBAL-257806-M • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2025-3048?
A vulnerability in AWS SAM CLI allows unauthorized access to symlinked content during the build process, as the content is copied to the local workspace cache as regular files or directories.
What is the CVSS score for CVE-2025-3048?
CVE-2025-3048 has CVSS 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS: 0.7%.
Is CVE-2025-3048 actively exploited?
No confirmed active exploitation of CVE-2025-3048 as of 2026-09-25.
How do I remediate CVE-2025-3048?
Priority: MEDIUM.
What systems are affected by CVE-2025-3048?
CVE-2025-3048 affects Docker; Serverless.
Vulnerability Details
CVE IDCVE-2025-3048
BSIDBS-2025-GLOBAL-257806-M BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Published2025-03-31
Last Modified2026-06-17
ICS Relevance0%
Weakness (CWE)
CWE-61
Domains
CLOUD
SourceNVD
Official Description

After completing a build with AWS Serverless Application Model Command Line Interface (SAM CLI) which include symlinks, the content of those symlinks are copied to the cache of the local workspace as regular files or directories. As a result, a user who does not have access to those symlinks outside of the Docker container would now have access via the local workspace. Users should upgrade to version 1.134.0 and ensure any forked or derivative code is patched to incorporate the new fixes. After upgrading, users must re-build their applications using the sam build --use-container to update the symlinks.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker with access to the local workspace after a build process involving symlinks can access files and directories that were originally restricted outside of the Docker container environment.

Exploitation Likelihood: MEDIUM

Affected Products
VendorProductAffected Versions
Docker — —
Serverless — —
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 563 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceMEDIUM
Enriched At2026-05-24
SHA-512 Audit Hashd92e2b385ee6a8d9603e68ceb3d1df669a2de476c00a84d5377d1ef5d3bb2cb17a15cc8b40b98e0152102fc0a01861cb2add671b0e96eb5af9edde884c0ac27b
Related CVEs affecting Docker
CVE-2024-29895 10.0 Cacti provides an operational monitoring and fault management framework. A co... CVE-2014-9357 10.0 Docker 1.3.2 allows remote attackers to execute arbitrary code with root priv... CVE-2026-42869 10.0 SOCFortress CoPilot focuses on providing a single pane of glass for all your ... CVE-2026-40089 9.9 Sonicverse is a Self-hosted Docker Compose stack for live radio streaming. Th... CVE-2026-42454 9.9 Termix is a web-based server management platform with SSH terminal, tunneling...
View all Docker CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →