The plabayo/rama project contains a stored/reflected cross-site scripting (XSS) vulnerability in the ServeDir HTML directory listing feature when configured with DirectoryServeMode::HtmlFileList. File names and URI path components are inserted into the generated HTML without proper escaping, allowing an attacker who can control or influence file or directory names to inject malicious HTML or JavaScript. This can lead to script execution in the browsers of users viewing the directory listing. The vulnerability affects version 0.3.0-rc.1 of rama. A fix involves properly escaping all untrusted values before embedding them in HTML. The severity is assessed as medium due to the requirement for attacker control over file names and user interaction.