The vulnerability in plabayo/rama arises from the ServeDir component generating HTML directory listings without escaping file names and URI path parts. Specifically, when ServeDir is used with DirectoryServeMode::HtmlFileList, file and directory names are directly inserted into HTML link text and href attributes, as well as navigation breadcrumbs and page titles, without HTML or attribute escaping. This allows an attacker who can create or influence file or directory names in the served directory to inject arbitrary HTML or JavaScript, resulting in stored or reflected XSS. The vulnerability is demonstrated by creating files with names containing HTML metacharacters that execute JavaScript when the directory listing is viewed. The root cause is the use of string formatting (format!) without escaping untrusted input. The recommended fix is to apply proper HTML and attribute escaping to all untrusted values before insertion into the generated HTML. The affected version is 0.3.0-rc.1. No official patch link is provided in the data.

If exploited, this vulnerability allows an attacker to execute arbitrary JavaScript in the browsers of users who visit the affected directory listing. This can lead to session or token theft, UI redressing, phishing attacks, unauthorized actions within the application origin, and compromise of security boundaries if the directory listing is served under a trusted domain. Exploitation requires the attacker to control or influence file or directory names and requires user interaction to view the malicious directory listing. The impact is limited to browser-side script execution within the application origin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The suggested fix is to escape all untrusted values before inserting them into the generated HTML, including HTML-escaping file and directory names used as link text, attribute-escaping values used inside href attributes, and escaping URI path components used in breadcrumbs, page titles, and headings. Until a patch is available, avoid enabling ServeDir with DirectoryServeMode::HtmlFileList on directories where untrusted users can create or influence file or directory names.