This vulnerability (CVE-2025-61686) involves improper limitation of a pathname to a restricted directory (CWE-22) in remix-run react-router components. Specifically, when using createFileSessionStorage() with an unsigned cookie, an attacker can cause the session mechanism to access files outside the designated session file directory. The attack's success depends on the server process's permissions. While direct file content disclosure is not possible, if an attacker can supply a file matching the session file format, they may influence server-side session data. The vulnerability affects @react-router/node versions >=7.0.0 <7.9.4, @remix-run/deno versions <2.17.2, and @remix-run/node versions <2.17.2. Official patches are available in @react-router/node 7.9.4 and @remix-run/deno and @remix-run/node 2.17.2. The CVSS v3.1 score is 9.1 (critical), reflecting network attack vector, low complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity and availability impact.

An attacker can exploit this vulnerability to cause the session storage to read or write files outside the intended session directory, potentially modifying server-side session data. Direct disclosure of file contents to the attacker is not possible. The impact depends on the permissions of the web server process and the application logic that uses session data. This can lead to integrity and availability impacts on the affected system.

A fix is available and has been released in @react-router/node version 7.9.4, @remix-run/deno version 2.17.2, and @remix-run/node version 2.17.2. Users should upgrade to these versions or later to remediate this vulnerability. Patch status is confirmed by the vendor advisory. No additional mitigation steps are indicated in the advisory.