CVE-2025-3047
CVE-2025-3047 is a medium-severity vulnerability with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-61.
Key facts
- Severity: Medium (CVSS 3.x base score 6.5)
- CVSS v4: 6.9
- EPSS exploit prediction: 1% (50th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2025-8754
- Weakness: CWE-61
- Published:
- Last modified:
Description
When running the AWS Serverless Application Model Command Line Interface (SAM CLI) build process with Docker and symlinks are included in the build files, the container environment allows a user to access privileged files on the host by leveraging the elevated permissions granted to the tool. A user could leverage the elevated permissions to access restricted files via symlinks and copy them to a more permissive location on the container. Users should upgrade to v1.133.0 or newer and ensure any forked or derivative code is patched to incorporate the new fixes.
Frequently asked questions
- What is CVE-2025-3047?
- When running the AWS Serverless Application Model Command Line Interface (SAM CLI) build process with Docker and symlinks are included in the build files, the container environment allows a user to access privileged files on the host by leveraging the elevated permissions granted to the tool. A user could leverage the elevated permissions to access restricted files via symlinks and copy them to a more permissive location on the container. Users should upgrade to v1.133.0 or newer and ensure any forked or derivative code is patched to incorporate the new fixes.
- How severe is CVE-2025-3047?
- CVE-2025-3047 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity none, and availability none.
- Is CVE-2025-3047 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (50th percentile), an estimate of the probability of exploitation in the next 30 days.
- How do I fix CVE-2025-3047?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- Does CVE-2025-3047 have an EU (EUVD) identifier?
- Yes. CVE-2025-3047 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-8754.
- When was CVE-2025-3047 published?
- CVE-2025-3047 was published on 2025-03-31 and last updated on 2026-06-17.
References
- https://aws.amazon.com/security/security-bulletins/AWS-2025-008/
- https://github.com/aws/aws-sam-cli/releases/tag/v1.134.0
- https://github.com/aws/aws-sam-cli/security/advisories/GHSA-px37-jpqx-97q9
Other CWE-61 vulnerabilities
- CVE-2026-34078 — Critical (CVSS 10.0): Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths…
- CVE-2025-62596 — Critical (CVSS 10.0): Youki is a container runtime written in Rust. In versions 0.5.6 and below, youki’s apparmor handling performs…
- CVE-2025-62161 — Critical (CVSS 10.0): Youki is a container runtime written in Rust. In versions 0.5.6 and below, the initial validation of the source…
- CVE-2025-23394 — Critical (CVSS 9.8): A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed cyrus-imapd allows escalation from cyrus…
- CVE-2024-54661 — Critical (CVSS 9.8): readline.sh in socat before1.8.0.2 relies on the /tmp/$USER/stderr2 file.
- CVE-2026-55447 — Critical (CVSS 9.6): Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.2, by controlling a files…