A cross-site scripting (XSS) vulnerability exists in aiohttp versions prior to 3.9.4 on index pages generated for static file handling when the show_index option is enabled. The vulnerability arises because file names are not escaped, allowing malicious filenames to execute scripts in users' browsers. This affects servers that serve static files directly with show_index enabled and allow users to upload files with arbitrary names. The vulnerability is fixed in version 3.9.4. Users employing a reverse proxy like nginx to serve static files or disabling show_index are not affected.