The #golang `gorilla/sessions` directory traversal and file (over)write is now being tracked as GO-2024-2730: https://go-review.googlesource.com/c/vulndb/+/579655 This issue was (co)-discovered as part of watchTowr's analysis of the Palo Alto Networks RCE (#CVE_2024_3400), but is entirely separate, and affects a wide range of Go-based web services. https://github.com/golang/vulndb/issues/2730 If you use gorilla/sessions with the FilesystemStore, please switch to the CookieStore instead until a patch is available.