What happened
A critical React Router flaws could let attackers access or modify server files vulnerability was disclosed in the React Router and @remix‑run packages, tracked as CVE‑2025‑61686. The flaw stems from improper handling of unsigned cookies in the createFileSessionStorage() function, where specially crafted session cookies containing directory traversal sequences enable attackers to reference and read files outside the intended session directory. Malicious actors could also write data to unauthorized file locations, potentially overwriting critical configuration or executable content depending on server file‑system permissions.
Who is affected
Developers and organizations using affected React Router or @remix‑run/node and @remix‑run/deno packages in server environments could see unauthorized file access or modification if applications mishandle session storage.
Why CISOs should care
Directory traversal and server file modification can lead to unauthorized data exposure, configuration tampering, or even code execution, increasing enterprise risk for web applications built on these frameworks.
3 practical actions
- Update dependencies: Upgrade to patched versions of React Router and Remix packages.
- Validate cookie handling: Ensure session cookies are signed and validated before use.
- Implement least privilege: Restrict file‑system permissions to limit read/write access by application processes.