Listen to this Post
The vulnerability exists within the `createFileSessionStorage()` function provided by `@react-router/node` (and analogous packages in Remix v2). This function manages session data by storing it in files on the server’s filesystem, using a session cookie to identify the correct file. The flaw occurs when an application uses an unsigned session cookie. An attacker can manipulate the session cookie value to inject directory traversal sequences (e.g., ../../../). When the function concatenates this tainted cookie value with the base directory path to resolve the session file location, it fails to properly sanitize the input. This allows the attacker to redirect file operations to arbitrary locations outside the intended session directory. Successful exploitation depends on the web server process’s file system permissions. While arbitrary file reads are constrained—the file must match a specific internal session format to be parsed—this can lead to server-side session pollution. File writes could corrupt or create files in unauthorized locations, potentially affecting server integrity.
Platform: React Router Node
Version: Affected versions
Vulnerability: Path Traversal
Severity: Critical
date: Jan 8 2026
Prediction: Patch Jan 15 2026
What Undercode Say:
`grep -r “createFileSessionStorage” src/`
`npm list @react-router/node`
curl -I --cookie "session=../../../etc/passwd" http://target/`dir`.
<h2 style="color: blue;">Checking for `sign` function absence in cookie configuration.</h2>
Code snippet: `createFileSessionStorage({ dir: "./sessions", cookie: { secrets: [] } // UNSIGNED });`
<h2 style="color: blue;">How Exploit:</h2>
<h2 style="color: blue;">Intercept session cookie.</h2>
<h2 style="color: blue;">Modify cookie value with `../` sequences.</h2>
<h2 style="color: blue;">Send crafted request to server.</h2>
<h2 style="color: blue;">Trigger file read/write outside
Access or corrupt system files.
Protection from this CVE
Use signed cookies.
Apply path validation/sanitization.
Update to patched version.
Restrict server filesystem permissions.
Implement strict session encoding.
Impact:
Arbitrary File Read.
Session Data Manipulation.
Potential System File Access.
Server Integrity Compromise.
Information Disclosure.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
