Remix-run - React-router - CRITICAL - CVE-2025-61686. A vulnerability in the file session storage mechanism of React Router and Remix allows potential attackers to manipulate session data if an unsigned cookie is utilized with createFileSessionStorage(). This could lead to unauthorized attempts to read or write session data from locations outside the designated session file directory. While direct file access by attackers isn't possible, the exploit's success hinges on the web server process's permissions. Should the manipulated files align with the expected session file format, there's a risk that session information could inadvertently be revealed to the application, depending on its logic. This issue has been addressed in recent updates released by the vendor.