React Router has Path Traversal in File Session Storage

The core of this vulnerability lies in the createFileSessionStorage() function within React Router Node, specifically when used with unsigned cookies. An attacker can craft a malicious cookie that manipulates the file path, tricking the application into attempting to read or write files outside the designated session storage directory. The success of this attack hinges on the web server process's permissions; if the server has write access to sensitive files, the attacker could potentially modify them. This could lead to session hijacking, data breaches, or even remote code execution if the attacker can overwrite configuration files or other critical system components. The impact is amplified in environments where session data is used for authentication or authorization.

Applications utilizing React Router Node for session management, particularly those relying on unsigned cookies for session identification, are at significant risk. Shared hosting environments where multiple applications share the same server and file system are especially vulnerable, as an attacker exploiting one application could potentially gain access to files belonging to others.

• react / node: Monitor application logs for attempts to access files outside the expected session storage directory. Look for unusual file paths containing .. sequences.

grep '..\/' /var/log/nginx/error.log

• react / node: Use a security scanner to identify instances of createFileSessionStorage() with unsigned cookies. • react / node: Review application code for any custom file path manipulation logic that might be vulnerable to path traversal. • react / node: Check for unusual file modifications within the session storage directory using file integrity monitoring tools.

1. 2026-01-10Disclosure

   disclosure

1. आरक्षित2025-09-29
2. प्रकाशित2026-01-10
3. संशोधित2026-03-03
4. EPSS अद्यतन2026-03-23

The primary mitigation for CVE-2025-61686 is to immediately upgrade React Router Node to version 7.9.4 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing stricter file permission controls on the session storage directory to limit the attacker's potential impact. Additionally, implement input validation and sanitization on any user-controlled data used in file paths. Web Application Firewalls (WAFs) configured with rules to detect and block path traversal attempts can provide an additional layer of defense. Monitor application logs for unusual file access patterns that might indicate exploitation.