CVE-2025-61686 affects React Router and Remix packages where createFileSessionStorage() with unsigned cookies allows attackers to read/write files outside the intended session directory. The vulnerability impacts @react-router/node versions 7.0.0-7.9.3, @remix-run/deno prior to 2.17.2, and @remix-run/node prior to 2.17.2. Successful exploitation depends on web server permissions and file format matching. While files cannot be directly returned to attackers, session data could be populated on the server side. The issue has been patched in @react-router/node 7.9.4, @remix-run/deno 2.17.2, and @remix-run/node 2.17.2.