CVE-2025-61686: 
JavaScript vulnerability analysis and mitigation

CVE-2025-61686 is a path traversal vulnerability in React Router's file session storage implementation, titled "React Router has Path Traversal in File Session Storage." It affects @react-router/node versions 7.0.0 through 7.9.3, and @remix-run/node / @remix-run/deno versions up to and including 2.17.1. The vulnerability was published on January 8, 2026, by researcher zaddy6 via the GitHub Advisory Database, and assigned CVE-2025-61686 on January 10, 2026. It carries a CVSS v3.1 base score of 9.1 (Critical) (GitHub Advisory, Red Hat Bugzilla).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — Path Traversal). When createFileSessionStorage() is used with an unsigned cookie, the session ID value stored in the cookie is used directly to construct a file path without adequate sanitization. An unauthenticated remote attacker can craft a malicious cookie value containing path traversal sequences (e.g., ../../) to direct the server to read from or write to arbitrary file system locations outside the designated session directory. Exploitation requires no privileges and no user interaction, and succeeds or fails based on the file system permissions of the web server process. The vulnerability does not apply when signed cookies are used, as the signature prevents tampering with the session ID (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation can result in high integrity and high availability impacts, though direct confidentiality impact is rated None by CVSS. An attacker may write arbitrary data to files accessible by the web server process, potentially corrupting application state or overwriting sensitive files, and may cause denial of service by targeting critical system files. While read files cannot be returned directly to the attacker, if a traversed file matches the expected session file format, its contents are silently loaded into the server-side session — meaning sensitive data could be indirectly exposed if application logic subsequently returns session values to the client. The actual blast radius depends entirely on the file system permissions granted to the web server process (GitHub Advisory).

As of the time of disclosure, there is no confirmed evidence of in-the-wild exploitation, and no public proof-of-concept exploit was initially available. However, a PoC repository (boroeurnprach/CVE-2025-61686-PoC) appeared on GitHub approximately two weeks after disclosure, indicating the vulnerability has been publicly demonstrated. The EPSS score is approximately 0.043% (13th percentile), suggesting a relatively low near-term exploitation probability. No threat actor attribution or CISA KEV catalog listing has been reported (GitHub Advisory, Feedly).

1. Reconnaissance: Identify web applications using createFileSessionStorage() from @react-router/node (v7.0.0–7.9.3) or @remix-run/node/@remix-run/deno (≤2.17.1) with unsigned cookies. This can be done by inspecting HTTP response headers, JavaScript bundle contents, or npm package manifests if accessible.
2. Confirm unsigned cookie usage: Send a normal request to the target application and inspect the session cookie. An unsigned cookie will lack a cryptographic signature suffix (e.g., no .s%3A prefix or HMAC appended), confirming the vulnerable configuration.
3. Craft malicious session cookie: Modify the session cookie value to include path traversal sequences pointing to a target file outside the session directory. For example, set the cookie to a value like ../../etc/passwd or a relative path targeting a sensitive configuration file accessible to the web server process.
4. Send the crafted request: Submit an HTTP request to the application with the manipulated cookie. The server will attempt to read or write a session file at the traversed path.
5. Exploit read behavior: If the targeted file matches the session file format (e.g., JSON), its contents will be loaded into the server-side session. If the application logic returns session data in responses, the attacker can retrieve the file contents indirectly.
6. Exploit write behavior: To write arbitrary content, trigger a session write operation (e.g., by performing an action that modifies session state) while the cookie points to a target path, potentially overwriting files with attacker-controlled session data (GitHub Advisory, Red Hat Bugzilla).

• Network: HTTP requests containing session cookies with path traversal sequences (e.g., ../, %2e%2e%2f, %2e%2e/) in the cookie value; repeated requests with varying traversal depths targeting the same endpoint.
• Logs: Web server access logs showing requests with malformed or unusually long session cookie values; application error logs indicating file-not-found or permission-denied errors for paths outside the session directory.
• File System: Unexpected modification timestamps on files outside the configured session storage directory; new or altered files in sensitive directories (e.g., /etc/, application config directories) owned by the web server process.
• Process: Unusual file I/O activity by the Node.js/Deno web server process accessing paths outside the session directory, detectable via tools like auditd, inotifywait, or eBPF-based monitoring (GitHub Advisory).

Upgrade to the patched versions immediately: @react-router/node ≥ 7.9.4, @remix-run/node ≥ 2.17.2, or @remix-run/deno ≥ 2.17.2. As an immediate workaround, ensure all cookies used with createFileSessionStorage() are signed — signed cookies prevent attackers from tampering with the session ID value and thus block the path traversal vector. Additionally, restrict the file system permissions of the web server process to the minimum necessary, limiting the directories it can read from or write to. Audit application code for any logic that returns session data directly to clients, which could amplify the confidentiality impact (GitHub Advisory, Red Hat Bugzilla).

The vulnerability received notable coverage from security news outlets including GBHackers, CyberSecurityNews, SecurityOnline, and The Hacker News (in a weekly recap), reflecting broad community awareness. The Belgian Centre for Cybersecurity (CCB) issued an advisory urging immediate patching. The Hacker Wire and Purple-Ops published dedicated technical analyses. Community sentiment on platforms like Bluesky and Infosec.exchange highlighted concern given React Router's widespread adoption in production web applications (GBHackers, CCB Advisory, SecurityOnline).