rama

Version	Released
`0.4.0` minor	Aug 19, 2026
`0.3.0` unknown	Jul 07, 2026
`0.3.0-rc1` unknown	Jul 04, 2026
`0.3.0-alpha.4` unknown 1 CVE	Dec 27, 2025
`0.3.0-alpha.3` unknown 1 CVE	Aug 29, 2025
`0.3.0-alpha.2` unknown 1 CVE	Aug 05, 2025
`0.3.0-alpha.1` unknown 1 CVE	Jul 07, 2025
`0.2.0` unknown 1 CVE	May 09, 2025
`0.2.0-alpha.15` unknown 1 CVE	May 08, 2025
`0.2.0-alpha.14` unknown 1 CVE	May 06, 2025
`0.2.0-alpha.13` unknown 1 CVE	Apr 25, 2025
`0.2.0-alpha.12` unknown 1 CVE	Apr 18, 2025
`0.2.0-alpha.11` unknown 1 CVE	Apr 16, 2025
`0.2.0-alpha.10` unknown 1 CVE	Apr 15, 2025
`0.2.0-alpha.9` unknown 1 CVE	Apr 15, 2025
`0.2.0-alpha.8` unknown 1 CVE	Apr 10, 2025
`0.2.0-alpha.7` unknown 1 CVE	Mar 11, 2025
`0.2.0-alpha.6` unknown 1 CVE	Jan 09, 2025
`0.2.0-alpha.5` unknown 1 CVE	Jan 05, 2025
`0.2.0-alpha.4` unknown 1 CVE	Dec 29, 2024
`0.2.0-alpha.3` unknown 1 CVE	Sep 09, 2024
`0.2.0-alpha.2` unknown 1 CVE	Sep 05, 2024
`0.2.0-alpha.1` unknown 1 CVE	Aug 18, 2024
`0.2.0-alpha.0` unknown 1 CVE	Jun 02, 2024
`0.1.0` unknown yanked 1 CVE	Sep 21, 2022

0.4.0 minor

Aug 19, 2026

0.3.0 unknown

Jul 07, 2026

0.3.0-rc1 unknown

Jul 04, 2026

0.3.0-alpha.4 unknown

1 CVE

GHSA-cwv4-h3j5-w3cf Jul 07, 2026

rama has Stored XSS in ServeDir HTML directory listing via unescaped file names and URI path

3.7 / 10

Low

Local High High Required Changed Low Low None

Resolved: https://github.com/plabayo/rama/commit/89ddff578fd78bbebec99482d7030f28c07757a3

Summary

plabayo/rama contains a stored/reflected cross-site scripting issue in the ServeDir HTML directory listing feature.

When ServeDir is configured with DirectoryServeMode::HtmlFileList, file names and URI path components are inserted directly into generated HTML without HTML escaping. If an attacker can create or influence a file or directory name inside a served directory, they may inject HTML or JavaScript into the directory listing page.

This can execute script in the browser of any user who visits the affected directory listing.

Affected Repository

plabayo/rama

Affected Component

rama-http/src/service/fs/serve_dir/open_file.rs

Root Cause

The HTML directory listing is constructed using string formatting and inserts untrusted values directly into HTML.

The directory listing row includes the file or directory name in both the link text and the href attribute:

rows.push(format!(
    "<tr><td>{5} <a href=\"{1}{2}{0}\">{0}</a></td><td>{3}</td><td>{4}</td></tr>",
    entry.name,
    uri.path().trim_end_matches('/'),
    ...
));

The navigation breadcrumb also inserts URI path parts into generated HTML:

nav_parts.push(format!("<a href=\"{current_path}\">{part}</a>"));

The page title and heading also include the current URI path:

<title>Directory listing for .{0}</title>
<h1>Directory listing for .{0}</h1>

These values are not HTML-escaped before being embedded into the generated page.

Security Impact

If an application uses ServeDir with DirectoryServeMode::HtmlFileList, an attacker who can create or influence file names inside the served directory can inject HTML or JavaScript into the generated directory listing.

Possible impact includes:

Script execution in the browser of users viewing the directory listing
Session or token theft if the application uses cookies or browser-accessible credentials
UI redressing or phishing inside the application origin
Unauthorized actions within the same origin if the victim is authenticated
Security boundary impact if the directory listing is served under a trusted application domain

The attack requires the directory listing feature to be enabled and the attacker to control or influence at least one file or directory name in the served path.

Proof of Concept

This proof of concept uses a benign payload.

Create a directory with a file name containing HTML:

mkdir rama-xss-test
cd rama-xss-test
touch '"><img src=x onerror=alert(document.domain)>.txt'

Serve this directory with Rama using ServeDir and DirectoryServeMode::HtmlFileList.

Example intended configuration:

ServeDir::new("rama-xss-test")
    .with_directory_serve_mode(DirectoryServeMode::HtmlFileList)

Then visit the directory listing in a browser.

Expected behavior:

The file name should be displayed as text. Special characters such as <, >, ", and ' should be HTML-escaped.

Actual behavior:

The file name is inserted directly into the generated HTML. The browser interprets the injected HTML and executes the benign JavaScript payload.

Expected Behavior

All file names, directory names, URI path parts, and other untrusted values should be escaped before being inserted into HTML.

For example:

< should become <
> should become >
" should become "
' should become '
& should become &

Untrusted values used inside HTML attributes should be escaped using an attribute-safe escaping function.

Actual Behavior

The directory listing is generated with format!() and inserts file names and path values directly into HTML without escaping.

Suggested Fix

Escape all untrusted values before inserting them into the generated HTML.

Recommended changes:

HTML-escape entry.name before using it as link text.
Attribute-escape values used inside href.
HTML-escape URI path components used in breadcrumbs.
HTML-escape the current path used in the page title and heading.
Add regression tests with file names containing HTML metacharacters.

Example test payloads:

"><img src=x onerror=alert(1)>.txt
<script>alert(1)</script>.txt
a&b.txt
quote"test.txt
single'test.txt

The secure output should render these as text only and should not create executable HTML or JavaScript.

Suggested Severity

Medium.

Suggested CVSS:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Rationale:

The vulnerability is remotely reachable when an application exposes ServeDir directory listings.
Exploitation requires the attacker to create or influence a file or directory name in the served directory.
User interaction is required because a victim must view the affected directory listing.
The impact is browser-side script execution in the application origin.
Scope may change if the listing is served under a trusted authenticated application origin.

Additional Notes

This report is limited to the HTML directory listing generated by ServeDir when DirectoryServeMode::HtmlFileList is enabled.

This report is not claiming remote code execution on the server. The issue is browser-side cross-site scripting caused by unescaped file names and path values in generated HTML.

Fixed in


          0.3.0-rc.1

References

Updated Jul 07, 2026 · Source: OSV.dev

Dec 27, 2025

0.3.0-alpha.3 unknown

1 CVE

GHSA-cwv4-h3j5-w3cf Jul 07, 2026

rama has Stored XSS in ServeDir HTML directory listing via unescaped file names and URI path

3.7 / 10

Low

Local High High Required Changed Low Low None

Resolved: https://github.com/plabayo/rama/commit/89ddff578fd78bbebec99482d7030f28c07757a3

Summary

plabayo/rama contains a stored/reflected cross-site scripting issue in the ServeDir HTML directory listing feature.

When ServeDir is configured with DirectoryServeMode::HtmlFileList, file names and URI path components are inserted directly into generated HTML without HTML escaping. If an attacker can create or influence a file or directory name inside a served directory, they may inject HTML or JavaScript into the directory listing page.

This can execute script in the browser of any user who visits the affected directory listing.

Affected Repository

plabayo/rama

Affected Component

rama-http/src/service/fs/serve_dir/open_file.rs

Root Cause

The HTML directory listing is constructed using string formatting and inserts untrusted values directly into HTML.

The directory listing row includes the file or directory name in both the link text and the href attribute:

rows.push(format!(
    "<tr><td>{5} <a href=\"{1}{2}{0}\">{0}</a></td><td>{3}</td><td>{4}</td></tr>",
    entry.name,
    uri.path().trim_end_matches('/'),
    ...
));

The navigation breadcrumb also inserts URI path parts into generated HTML:

nav_parts.push(format!("<a href=\"{current_path}\">{part}</a>"));

The page title and heading also include the current URI path:

<title>Directory listing for .{0}</title>
<h1>Directory listing for .{0}</h1>

These values are not HTML-escaped before being embedded into the generated page.

Security Impact

If an application uses ServeDir with DirectoryServeMode::HtmlFileList, an attacker who can create or influence file names inside the served directory can inject HTML or JavaScript into the generated directory listing.

Possible impact includes:

Script execution in the browser of users viewing the directory listing
Session or token theft if the application uses cookies or browser-accessible credentials
UI redressing or phishing inside the application origin
Unauthorized actions within the same origin if the victim is authenticated
Security boundary impact if the directory listing is served under a trusted application domain

The attack requires the directory listing feature to be enabled and the attacker to control or influence at least one file or directory name in the served path.

Proof of Concept

This proof of concept uses a benign payload.

Create a directory with a file name containing HTML:

mkdir rama-xss-test
cd rama-xss-test
touch '"><img src=x onerror=alert(document.domain)>.txt'

Serve this directory with Rama using ServeDir and DirectoryServeMode::HtmlFileList.

Example intended configuration:

ServeDir::new("rama-xss-test")
    .with_directory_serve_mode(DirectoryServeMode::HtmlFileList)

Then visit the directory listing in a browser.

Expected behavior:

The file name should be displayed as text. Special characters such as <, >, ", and ' should be HTML-escaped.

Actual behavior:

The file name is inserted directly into the generated HTML. The browser interprets the injected HTML and executes the benign JavaScript payload.

Expected Behavior

All file names, directory names, URI path parts, and other untrusted values should be escaped before being inserted into HTML.

For example:

< should become <
> should become >
" should become "
' should become '
& should become &

Untrusted values used inside HTML attributes should be escaped using an attribute-safe escaping function.

Actual Behavior

The directory listing is generated with format!() and inserts file names and path values directly into HTML without escaping.

Suggested Fix

Escape all untrusted values before inserting them into the generated HTML.

Recommended changes:

HTML-escape entry.name before using it as link text.
Attribute-escape values used inside href.
HTML-escape URI path components used in breadcrumbs.
HTML-escape the current path used in the page title and heading.
Add regression tests with file names containing HTML metacharacters.

Example test payloads:

"><img src=x onerror=alert(1)>.txt
<script>alert(1)</script>.txt
a&b.txt
quote"test.txt
single'test.txt

The secure output should render these as text only and should not create executable HTML or JavaScript.

Suggested Severity

Medium.

Suggested CVSS:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Rationale:

The vulnerability is remotely reachable when an application exposes ServeDir directory listings.
Exploitation requires the attacker to create or influence a file or directory name in the served directory.
User interaction is required because a victim must view the affected directory listing.
The impact is browser-side script execution in the application origin.
Scope may change if the listing is served under a trusted authenticated application origin.

Additional Notes

This report is limited to the HTML directory listing generated by ServeDir when DirectoryServeMode::HtmlFileList is enabled.

This report is not claiming remote code execution on the server. The issue is browser-side cross-site scripting caused by unescaped file names and path values in generated HTML.

Fixed in


          0.3.0-rc.1

References

Updated Jul 07, 2026 · Source: OSV.dev

Aug 29, 2025

0.3.0-alpha.2 unknown

1 CVE

GHSA-cwv4-h3j5-w3cf Jul 07, 2026

rama has Stored XSS in ServeDir HTML directory listing via unescaped file names and URI path

3.7 / 10

Low

Local High High Required Changed Low Low None

Resolved: https://github.com/plabayo/rama/commit/89ddff578fd78bbebec99482d7030f28c07757a3

Summary

plabayo/rama contains a stored/reflected cross-site scripting issue in the ServeDir HTML directory listing feature.

When ServeDir is configured with DirectoryServeMode::HtmlFileList, file names and URI path components are inserted directly into generated HTML without HTML escaping. If an attacker can create or influence a file or directory name inside a served directory, they may inject HTML or JavaScript into the directory listing page.

This can execute script in the browser of any user who visits the affected directory listing.

Affected Repository

plabayo/rama

Affected Component

rama-http/src/service/fs/serve_dir/open_file.rs

Root Cause

The HTML directory listing is constructed using string formatting and inserts untrusted values directly into HTML.

The directory listing row includes the file or directory name in both the link text and the href attribute:

rows.push(format!(
    "<tr><td>{5} <a href=\"{1}{2}{0}\">{0}</a></td><td>{3}</td><td>{4}</td></tr>",
    entry.name,
    uri.path().trim_end_matches('/'),
    ...
));

The navigation breadcrumb also inserts URI path parts into generated HTML:

nav_parts.push(format!("<a href=\"{current_path}\">{part}</a>"));

The page title and heading also include the current URI path:

<title>Directory listing for .{0}</title>
<h1>Directory listing for .{0}</h1>

These values are not HTML-escaped before being embedded into the generated page.

Security Impact

If an application uses ServeDir with DirectoryServeMode::HtmlFileList, an attacker who can create or influence file names inside the served directory can inject HTML or JavaScript into the generated directory listing.

Possible impact includes:

Script execution in the browser of users viewing the directory listing
Session or token theft if the application uses cookies or browser-accessible credentials
UI redressing or phishing inside the application origin
Unauthorized actions within the same origin if the victim is authenticated
Security boundary impact if the directory listing is served under a trusted application domain

The attack requires the directory listing feature to be enabled and the attacker to control or influence at least one file or directory name in the served path.

Proof of Concept

This proof of concept uses a benign payload.

Create a directory with a file name containing HTML:

mkdir rama-xss-test
cd rama-xss-test
touch '"><img src=x onerror=alert(document.domain)>.txt'

Serve this directory with Rama using ServeDir and DirectoryServeMode::HtmlFileList.

Example intended configuration:

ServeDir::new("rama-xss-test")
    .with_directory_serve_mode(DirectoryServeMode::HtmlFileList)

Then visit the directory listing in a browser.

Expected behavior:

The file name should be displayed as text. Special characters such as <, >, ", and ' should be HTML-escaped.

Actual behavior:

The file name is inserted directly into the generated HTML. The browser interprets the injected HTML and executes the benign JavaScript payload.

Expected Behavior

All file names, directory names, URI path parts, and other untrusted values should be escaped before being inserted into HTML.

For example:

< should become <
> should become >
" should become "
' should become '
& should become &

Untrusted values used inside HTML attributes should be escaped using an attribute-safe escaping function.

Actual Behavior

The directory listing is generated with format!() and inserts file names and path values directly into HTML without escaping.

Suggested Fix

Escape all untrusted values before inserting them into the generated HTML.

Recommended changes:

HTML-escape entry.name before using it as link text.
Attribute-escape values used inside href.
HTML-escape URI path components used in breadcrumbs.
HTML-escape the current path used in the page title and heading.
Add regression tests with file names containing HTML metacharacters.

Example test payloads:

"><img src=x onerror=alert(1)>.txt
<script>alert(1)</script>.txt
a&b.txt
quote"test.txt
single'test.txt

The secure output should render these as text only and should not create executable HTML or JavaScript.

Suggested Severity

Medium.

Suggested CVSS:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Rationale:

The vulnerability is remotely reachable when an application exposes ServeDir directory listings.
Exploitation requires the attacker to create or influence a file or directory name in the served directory.
User interaction is required because a victim must view the affected directory listing.
The impact is browser-side script execution in the application origin.
Scope may change if the listing is served under a trusted authenticated application origin.

Additional Notes

This report is limited to the HTML directory listing generated by ServeDir when DirectoryServeMode::HtmlFileList is enabled.

This report is not claiming remote code execution on the server. The issue is browser-side cross-site scripting caused by unescaped file names and path values in generated HTML.

Fixed in


          0.3.0-rc.1

References

Updated Jul 07, 2026 · Source: OSV.dev

Aug 05, 2025

0.3.0-alpha.1 unknown

1 CVE

GHSA-cwv4-h3j5-w3cf Jul 07, 2026

rama has Stored XSS in ServeDir HTML directory listing via unescaped file names and URI path

3.7 / 10

Low

Local High High Required Changed Low Low None

Resolved: https://github.com/plabayo/rama/commit/89ddff578fd78bbebec99482d7030f28c07757a3

Summary

plabayo/rama contains a stored/reflected cross-site scripting issue in the ServeDir HTML directory listing feature.

When ServeDir is configured with DirectoryServeMode::HtmlFileList, file names and URI path components are inserted directly into generated HTML without HTML escaping. If an attacker can create or influence a file or directory name inside a served directory, they may inject HTML or JavaScript into the directory listing page.

This can execute script in the browser of any user who visits the affected directory listing.

Affected Repository

plabayo/rama

Affected Component

rama-http/src/service/fs/serve_dir/open_file.rs

Root Cause

The HTML directory listing is constructed using string formatting and inserts untrusted values directly into HTML.

The directory listing row includes the file or directory name in both the link text and the href attribute:

rows.push(format!(
    "<tr><td>{5} <a href=\"{1}{2}{0}\">{0}</a></td><td>{3}</td><td>{4}</td></tr>",
    entry.name,
    uri.path().trim_end_matches('/'),
    ...
));

The navigation breadcrumb also inserts URI path parts into generated HTML:

nav_parts.push(format!("<a href=\"{current_path}\">{part}</a>"));

The page title and heading also include the current URI path:

<title>Directory listing for .{0}</title>
<h1>Directory listing for .{0}</h1>

These values are not HTML-escaped before being embedded into the generated page.

Security Impact

If an application uses ServeDir with DirectoryServeMode::HtmlFileList, an attacker who can create or influence file names inside the served directory can inject HTML or JavaScript into the generated directory listing.

Possible impact includes:

Script execution in the browser of users viewing the directory listing
Session or token theft if the application uses cookies or browser-accessible credentials
UI redressing or phishing inside the application origin
Unauthorized actions within the same origin if the victim is authenticated
Security boundary impact if the directory listing is served under a trusted application domain

The attack requires the directory listing feature to be enabled and the attacker to control or influence at least one file or directory name in the served path.

Proof of Concept

This proof of concept uses a benign payload.

Create a directory with a file name containing HTML:

mkdir rama-xss-test
cd rama-xss-test
touch '"><img src=x onerror=alert(document.domain)>.txt'

Serve this directory with Rama using ServeDir and DirectoryServeMode::HtmlFileList.

Example intended configuration:

ServeDir::new("rama-xss-test")
    .with_directory_serve_mode(DirectoryServeMode::HtmlFileList)

Then visit the directory listing in a browser.

Expected behavior:

The file name should be displayed as text. Special characters such as <, >, ", and ' should be HTML-escaped.

Actual behavior:

The file name is inserted directly into the generated HTML. The browser interprets the injected HTML and executes the benign JavaScript payload.

Expected Behavior

All file names, directory names, URI path parts, and other untrusted values should be escaped before being inserted into HTML.

For example:

< should become <
> should become >
" should become "
' should become '
& should become &

Untrusted values used inside HTML attributes should be escaped using an attribute-safe escaping function.

Actual Behavior

The directory listing is generated with format!() and inserts file names and path values directly into HTML without escaping.

Suggested Fix

Escape all untrusted values before inserting them into the generated HTML.

Recommended changes:

HTML-escape entry.name before using it as link text.
Attribute-escape values used inside href.
HTML-escape URI path components used in breadcrumbs.
HTML-escape the current path used in the page title and heading.
Add regression tests with file names containing HTML metacharacters.

Example test payloads:

"><img src=x onerror=alert(1)>.txt
<script>alert(1)</script>.txt
a&b.txt
quote"test.txt
single'test.txt

The secure output should render these as text only and should not create executable HTML or JavaScript.

Suggested Severity

Medium.

Suggested CVSS:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Rationale:

The vulnerability is remotely reachable when an application exposes ServeDir directory listings.
Exploitation requires the attacker to create or influence a file or directory name in the served directory.
User interaction is required because a victim must view the affected directory listing.
The impact is browser-side script execution in the application origin.
Scope may change if the listing is served under a trusted authenticated application origin.

Additional Notes

This report is limited to the HTML directory listing generated by ServeDir when DirectoryServeMode::HtmlFileList is enabled.

This report is not claiming remote code execution on the server. The issue is browser-side cross-site scripting caused by unescaped file names and path values in generated HTML.

Fixed in


          0.3.0-rc.1

References

Updated Jul 07, 2026 · Source: OSV.dev

Jul 07, 2025

0.2.0 unknown

1 CVE

GHSA-cwv4-h3j5-w3cf Jul 07, 2026

rama has Stored XSS in ServeDir HTML directory listing via unescaped file names and URI path

3.7 / 10

Low

Local High High Required Changed Low Low None

Resolved: https://github.com/plabayo/rama/commit/89ddff578fd78bbebec99482d7030f28c07757a3

Summary

plabayo/rama contains a stored/reflected cross-site scripting issue in the ServeDir HTML directory listing feature.

When ServeDir is configured with DirectoryServeMode::HtmlFileList, file names and URI path components are inserted directly into generated HTML without HTML escaping. If an attacker can create or influence a file or directory name inside a served directory, they may inject HTML or JavaScript into the directory listing page.

This can execute script in the browser of any user who visits the affected directory listing.

Affected Repository

plabayo/rama

Affected Component

rama-http/src/service/fs/serve_dir/open_file.rs

Root Cause

The HTML directory listing is constructed using string formatting and inserts untrusted values directly into HTML.

The directory listing row includes the file or directory name in both the link text and the href attribute:

rows.push(format!(
    "<tr><td>{5} <a href=\"{1}{2}{0}\">{0}</a></td><td>{3}</td><td>{4}</td></tr>",
    entry.name,
    uri.path().trim_end_matches('/'),
    ...
));

The navigation breadcrumb also inserts URI path parts into generated HTML:

nav_parts.push(format!("<a href=\"{current_path}\">{part}</a>"));

The page title and heading also include the current URI path:

<title>Directory listing for .{0}</title>
<h1>Directory listing for .{0}</h1>

These values are not HTML-escaped before being embedded into the generated page.

Security Impact

If an application uses ServeDir with DirectoryServeMode::HtmlFileList, an attacker who can create or influence file names inside the served directory can inject HTML or JavaScript into the generated directory listing.

Possible impact includes:

Script execution in the browser of users viewing the directory listing
Session or token theft if the application uses cookies or browser-accessible credentials
UI redressing or phishing inside the application origin
Unauthorized actions within the same origin if the victim is authenticated
Security boundary impact if the directory listing is served under a trusted application domain

The attack requires the directory listing feature to be enabled and the attacker to control or influence at least one file or directory name in the served path.

Proof of Concept

This proof of concept uses a benign payload.

Create a directory with a file name containing HTML:

mkdir rama-xss-test
cd rama-xss-test
touch '"><img src=x onerror=alert(document.domain)>.txt'

Serve this directory with Rama using ServeDir and DirectoryServeMode::HtmlFileList.

Example intended configuration:

ServeDir::new("rama-xss-test")
    .with_directory_serve_mode(DirectoryServeMode::HtmlFileList)

Then visit the directory listing in a browser.

Expected behavior:

The file name should be displayed as text. Special characters such as <, >, ", and ' should be HTML-escaped.

Actual behavior:

The file name is inserted directly into the generated HTML. The browser interprets the injected HTML and executes the benign JavaScript payload.

Expected Behavior

All file names, directory names, URI path parts, and other untrusted values should be escaped before being inserted into HTML.

For example:

< should become <
> should become >
" should become "
' should become '
& should become &

Untrusted values used inside HTML attributes should be escaped using an attribute-safe escaping function.

Actual Behavior

The directory listing is generated with format!() and inserts file names and path values directly into HTML without escaping.

Suggested Fix

Escape all untrusted values before inserting them into the generated HTML.

Recommended changes:

HTML-escape entry.name before using it as link text.
Attribute-escape values used inside href.
HTML-escape URI path components used in breadcrumbs.
HTML-escape the current path used in the page title and heading.
Add regression tests with file names containing HTML metacharacters.

Example test payloads:

"><img src=x onerror=alert(1)>.txt
<script>alert(1)</script>.txt
a&b.txt
quote"test.txt
single'test.txt

The secure output should render these as text only and should not create executable HTML or JavaScript.

Suggested Severity

Medium.

Suggested CVSS:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Rationale:

The vulnerability is remotely reachable when an application exposes ServeDir directory listings.
Exploitation requires the attacker to create or influence a file or directory name in the served directory.
User interaction is required because a victim must view the affected directory listing.
The impact is browser-side script execution in the application origin.
Scope may change if the listing is served under a trusted authenticated application origin.

Additional Notes

This report is limited to the HTML directory listing generated by ServeDir when DirectoryServeMode::HtmlFileList is enabled.

This report is not claiming remote code execution on the server. The issue is browser-side cross-site scripting caused by unescaped file names and path values in generated HTML.

Fixed in


          0.3.0-rc.1

References

Updated Jul 07, 2026 · Source: OSV.dev

May 09, 2025

0.2.0-alpha.15 unknown

1 CVE

GHSA-cwv4-h3j5-w3cf Jul 07, 2026

rama has Stored XSS in ServeDir HTML directory listing via unescaped file names and URI path

3.7 / 10

Low

Local High High Required Changed Low Low None

Resolved: https://github.com/plabayo/rama/commit/89ddff578fd78bbebec99482d7030f28c07757a3

Summary

plabayo/rama contains a stored/reflected cross-site scripting issue in the ServeDir HTML directory listing feature.

When ServeDir is configured with DirectoryServeMode::HtmlFileList, file names and URI path components are inserted directly into generated HTML without HTML escaping. If an attacker can create or influence a file or directory name inside a served directory, they may inject HTML or JavaScript into the directory listing page.

This can execute script in the browser of any user who visits the affected directory listing.

Affected Repository

plabayo/rama

Affected Component

rama-http/src/service/fs/serve_dir/open_file.rs

Root Cause

The HTML directory listing is constructed using string formatting and inserts untrusted values directly into HTML.

The directory listing row includes the file or directory name in both the link text and the href attribute:

rows.push(format!(
    "<tr><td>{5} <a href=\"{1}{2}{0}\">{0}</a></td><td>{3}</td><td>{4}</td></tr>",
    entry.name,
    uri.path().trim_end_matches('/'),
    ...
));

The navigation breadcrumb also inserts URI path parts into generated HTML:

nav_parts.push(format!("<a href=\"{current_path}\">{part}</a>"));

The page title and heading also include the current URI path:

<title>Directory listing for .{0}</title>
<h1>Directory listing for .{0}</h1>

These values are not HTML-escaped before being embedded into the generated page.

Security Impact

If an application uses ServeDir with DirectoryServeMode::HtmlFileList, an attacker who can create or influence file names inside the served directory can inject HTML or JavaScript into the generated directory listing.

Possible impact includes:

Script execution in the browser of users viewing the directory listing
Session or token theft if the application uses cookies or browser-accessible credentials
UI redressing or phishing inside the application origin
Unauthorized actions within the same origin if the victim is authenticated
Security boundary impact if the directory listing is served under a trusted application domain

The attack requires the directory listing feature to be enabled and the attacker to control or influence at least one file or directory name in the served path.

Proof of Concept

This proof of concept uses a benign payload.

Create a directory with a file name containing HTML:

mkdir rama-xss-test
cd rama-xss-test
touch '"><img src=x onerror=alert(document.domain)>.txt'

Serve this directory with Rama using ServeDir and DirectoryServeMode::HtmlFileList.

Example intended configuration:

ServeDir::new("rama-xss-test")
    .with_directory_serve_mode(DirectoryServeMode::HtmlFileList)

Then visit the directory listing in a browser.

Expected behavior:

The file name should be displayed as text. Special characters such as <, >, ", and ' should be HTML-escaped.

Actual behavior:

The file name is inserted directly into the generated HTML. The browser interprets the injected HTML and executes the benign JavaScript payload.

Expected Behavior

All file names, directory names, URI path parts, and other untrusted values should be escaped before being inserted into HTML.

For example:

< should become <
> should become >
" should become "
' should become '
& should become &

Untrusted values used inside HTML attributes should be escaped using an attribute-safe escaping function.

Actual Behavior

The directory listing is generated with format!() and inserts file names and path values directly into HTML without escaping.

Suggested Fix

Escape all untrusted values before inserting them into the generated HTML.

Recommended changes:

HTML-escape entry.name before using it as link text.
Attribute-escape values used inside href.
HTML-escape URI path components used in breadcrumbs.
HTML-escape the current path used in the page title and heading.
Add regression tests with file names containing HTML metacharacters.

Example test payloads:

"><img src=x onerror=alert(1)>.txt
<script>alert(1)</script>.txt
a&b.txt
quote"test.txt
single'test.txt

The secure output should render these as text only and should not create executable HTML or JavaScript.

Suggested Severity

Medium.

Suggested CVSS:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Rationale:

The vulnerability is remotely reachable when an application exposes ServeDir directory listings.
Exploitation requires the attacker to create or influence a file or directory name in the served directory.
User interaction is required because a victim must view the affected directory listing.
The impact is browser-side script execution in the application origin.
Scope may change if the listing is served under a trusted authenticated application origin.

Additional Notes

This report is limited to the HTML directory listing generated by ServeDir when DirectoryServeMode::HtmlFileList is enabled.

This report is not claiming remote code execution on the server. The issue is browser-side cross-site scripting caused by unescaped file names and path values in generated HTML.

Fixed in


          0.3.0-rc.1

References

Updated Jul 07, 2026 · Source: OSV.dev

May 08, 2025

0.2.0-alpha.14 unknown

1 CVE

GHSA-cwv4-h3j5-w3cf Jul 07, 2026

rama has Stored XSS in ServeDir HTML directory listing via unescaped file names and URI path

3.7 / 10

Low

Local High High Required Changed Low Low None

Resolved: https://github.com/plabayo/rama/commit/89ddff578fd78bbebec99482d7030f28c07757a3

Summary

plabayo/rama contains a stored/reflected cross-site scripting issue in the ServeDir HTML directory listing feature.

When ServeDir is configured with DirectoryServeMode::HtmlFileList, file names and URI path components are inserted directly into generated HTML without HTML escaping. If an attacker can create or influence a file or directory name inside a served directory, they may inject HTML or JavaScript into the directory listing page.

This can execute script in the browser of any user who visits the affected directory listing.

Affected Repository

plabayo/rama

Affected Component

rama-http/src/service/fs/serve_dir/open_file.rs

Root Cause

The HTML directory listing is constructed using string formatting and inserts untrusted values directly into HTML.

The directory listing row includes the file or directory name in both the link text and the href attribute:

rows.push(format!(
    "<tr><td>{5} <a href=\"{1}{2}{0}\">{0}</a></td><td>{3}</td><td>{4}</td></tr>",
    entry.name,
    uri.path().trim_end_matches('/'),
    ...
));

The navigation breadcrumb also inserts URI path parts into generated HTML:

nav_parts.push(format!("<a href=\"{current_path}\">{part}</a>"));

The page title and heading also include the current URI path:

<title>Directory listing for .{0}</title>
<h1>Directory listing for .{0}</h1>

These values are not HTML-escaped before being embedded into the generated page.

Security Impact

If an application uses ServeDir with DirectoryServeMode::HtmlFileList, an attacker who can create or influence file names inside the served directory can inject HTML or JavaScript into the generated directory listing.

Possible impact includes:

Script execution in the browser of users viewing the directory listing
Session or token theft if the application uses cookies or browser-accessible credentials
UI redressing or phishing inside the application origin
Unauthorized actions within the same origin if the victim is authenticated
Security boundary impact if the directory listing is served under a trusted application domain

The attack requires the directory listing feature to be enabled and the attacker to control or influence at least one file or directory name in the served path.

Proof of Concept

This proof of concept uses a benign payload.

Create a directory with a file name containing HTML:

mkdir rama-xss-test
cd rama-xss-test
touch '"><img src=x onerror=alert(document.domain)>.txt'

Serve this directory with Rama using ServeDir and DirectoryServeMode::HtmlFileList.

Example intended configuration:

ServeDir::new("rama-xss-test")
    .with_directory_serve_mode(DirectoryServeMode::HtmlFileList)

Then visit the directory listing in a browser.

Expected behavior:

The file name should be displayed as text. Special characters such as <, >, ", and ' should be HTML-escaped.

Actual behavior:

The file name is inserted directly into the generated HTML. The browser interprets the injected HTML and executes the benign JavaScript payload.

Expected Behavior

All file names, directory names, URI path parts, and other untrusted values should be escaped before being inserted into HTML.

For example:

< should become <
> should become >
" should become "
' should become '
& should become &

Untrusted values used inside HTML attributes should be escaped using an attribute-safe escaping function.

Actual Behavior

The directory listing is generated with format!() and inserts file names and path values directly into HTML without escaping.

Suggested Fix

Escape all untrusted values before inserting them into the generated HTML.

Recommended changes:

HTML-escape entry.name before using it as link text.
Attribute-escape values used inside href.
HTML-escape URI path components used in breadcrumbs.
HTML-escape the current path used in the page title and heading.
Add regression tests with file names containing HTML metacharacters.

Example test payloads:

"><img src=x onerror=alert(1)>.txt
<script>alert(1)</script>.txt
a&b.txt
quote"test.txt
single'test.txt

The secure output should render these as text only and should not create executable HTML or JavaScript.

Suggested Severity

Medium.

Suggested CVSS:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Rationale:

The vulnerability is remotely reachable when an application exposes ServeDir directory listings.
Exploitation requires the attacker to create or influence a file or directory name in the served directory.
User interaction is required because a victim must view the affected directory listing.
The impact is browser-side script execution in the application origin.
Scope may change if the listing is served under a trusted authenticated application origin.

Additional Notes

This report is limited to the HTML directory listing generated by ServeDir when DirectoryServeMode::HtmlFileList is enabled.

This report is not claiming remote code execution on the server. The issue is browser-side cross-site scripting caused by unescaped file names and path values in generated HTML.

Fixed in


          0.3.0-rc.1

References

Updated Jul 07, 2026 · Source: OSV.dev

May 06, 2025

0.2.0-alpha.13 unknown

1 CVE

GHSA-cwv4-h3j5-w3cf Jul 07, 2026

rama has Stored XSS in ServeDir HTML directory listing via unescaped file names and URI path

3.7 / 10

Low

Local High High Required Changed Low Low None

Resolved: https://github.com/plabayo/rama/commit/89ddff578fd78bbebec99482d7030f28c07757a3

Summary

plabayo/rama contains a stored/reflected cross-site scripting issue in the ServeDir HTML directory listing feature.

When ServeDir is configured with DirectoryServeMode::HtmlFileList, file names and URI path components are inserted directly into generated HTML without HTML escaping. If an attacker can create or influence a file or directory name inside a served directory, they may inject HTML or JavaScript into the directory listing page.

This can execute script in the browser of any user who visits the affected directory listing.

Affected Repository

plabayo/rama

Affected Component

rama-http/src/service/fs/serve_dir/open_file.rs

Root Cause

The HTML directory listing is constructed using string formatting and inserts untrusted values directly into HTML.

The directory listing row includes the file or directory name in both the link text and the href attribute:

rows.push(format!(
    "<tr><td>{5} <a href=\"{1}{2}{0}\">{0}</a></td><td>{3}</td><td>{4}</td></tr>",
    entry.name,
    uri.path().trim_end_matches('/'),
    ...
));

The navigation breadcrumb also inserts URI path parts into generated HTML:

nav_parts.push(format!("<a href=\"{current_path}\">{part}</a>"));

The page title and heading also include the current URI path:

<title>Directory listing for .{0}</title>
<h1>Directory listing for .{0}</h1>

These values are not HTML-escaped before being embedded into the generated page.

Security Impact

If an application uses ServeDir with DirectoryServeMode::HtmlFileList, an attacker who can create or influence file names inside the served directory can inject HTML or JavaScript into the generated directory listing.

Possible impact includes:

Script execution in the browser of users viewing the directory listing
Session or token theft if the application uses cookies or browser-accessible credentials
UI redressing or phishing inside the application origin
Unauthorized actions within the same origin if the victim is authenticated
Security boundary impact if the directory listing is served under a trusted application domain

The attack requires the directory listing feature to be enabled and the attacker to control or influence at least one file or directory name in the served path.

Proof of Concept

This proof of concept uses a benign payload.

Create a directory with a file name containing HTML:

mkdir rama-xss-test
cd rama-xss-test
touch '"><img src=x onerror=alert(document.domain)>.txt'

Serve this directory with Rama using ServeDir and DirectoryServeMode::HtmlFileList.

Example intended configuration:

ServeDir::new("rama-xss-test")
    .with_directory_serve_mode(DirectoryServeMode::HtmlFileList)

Then visit the directory listing in a browser.

Expected behavior:

The file name should be displayed as text. Special characters such as <, >, ", and ' should be HTML-escaped.

Actual behavior:

The file name is inserted directly into the generated HTML. The browser interprets the injected HTML and executes the benign JavaScript payload.

Expected Behavior

All file names, directory names, URI path parts, and other untrusted values should be escaped before being inserted into HTML.

For example:

< should become <
> should become >
" should become "
' should become '
& should become &

Untrusted values used inside HTML attributes should be escaped using an attribute-safe escaping function.

Actual Behavior

The directory listing is generated with format!() and inserts file names and path values directly into HTML without escaping.

Suggested Fix

Escape all untrusted values before inserting them into the generated HTML.

Recommended changes:

HTML-escape entry.name before using it as link text.
Attribute-escape values used inside href.
HTML-escape URI path components used in breadcrumbs.
HTML-escape the current path used in the page title and heading.
Add regression tests with file names containing HTML metacharacters.

Example test payloads:

"><img src=x onerror=alert(1)>.txt
<script>alert(1)</script>.txt
a&b.txt
quote"test.txt
single'test.txt

The secure output should render these as text only and should not create executable HTML or JavaScript.

Suggested Severity

Medium.

Suggested CVSS:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Rationale:

The vulnerability is remotely reachable when an application exposes ServeDir directory listings.
Exploitation requires the attacker to create or influence a file or directory name in the served directory.
User interaction is required because a victim must view the affected directory listing.
The impact is browser-side script execution in the application origin.
Scope may change if the listing is served under a trusted authenticated application origin.

Additional Notes

This report is limited to the HTML directory listing generated by ServeDir when DirectoryServeMode::HtmlFileList is enabled.

This report is not claiming remote code execution on the server. The issue is browser-side cross-site scripting caused by unescaped file names and path values in generated HTML.

Fixed in


          0.3.0-rc.1

References

Updated Jul 07, 2026 · Source: OSV.dev

Apr 25, 2025

0.2.0-alpha.12 unknown

1 CVE

GHSA-cwv4-h3j5-w3cf Jul 07, 2026

rama has Stored XSS in ServeDir HTML directory listing via unescaped file names and URI path

3.7 / 10

Low

Local High High Required Changed Low Low None

Resolved: https://github.com/plabayo/rama/commit/89ddff578fd78bbebec99482d7030f28c07757a3

Summary

plabayo/rama contains a stored/reflected cross-site scripting issue in the ServeDir HTML directory listing feature.

When ServeDir is configured with DirectoryServeMode::HtmlFileList, file names and URI path components are inserted directly into generated HTML without HTML escaping. If an attacker can create or influence a file or directory name inside a served directory, they may inject HTML or JavaScript into the directory listing page.

This can execute script in the browser of any user who visits the affected directory listing.

Affected Repository

plabayo/rama

Affected Component

rama-http/src/service/fs/serve_dir/open_file.rs

Root Cause

The HTML directory listing is constructed using string formatting and inserts untrusted values directly into HTML.

The directory listing row includes the file or directory name in both the link text and the href attribute:

rows.push(format!(
    "<tr><td>{5} <a href=\"{1}{2}{0}\">{0}</a></td><td>{3}</td><td>{4}</td></tr>",
    entry.name,
    uri.path().trim_end_matches('/'),
    ...
));

The navigation breadcrumb also inserts URI path parts into generated HTML:

nav_parts.push(format!("<a href=\"{current_path}\">{part}</a>"));

The page title and heading also include the current URI path:

<title>Directory listing for .{0}</title>
<h1>Directory listing for .{0}</h1>

These values are not HTML-escaped before being embedded into the generated page.

Security Impact

If an application uses ServeDir with DirectoryServeMode::HtmlFileList, an attacker who can create or influence file names inside the served directory can inject HTML or JavaScript into the generated directory listing.

Possible impact includes:

Script execution in the browser of users viewing the directory listing
Session or token theft if the application uses cookies or browser-accessible credentials
UI redressing or phishing inside the application origin
Unauthorized actions within the same origin if the victim is authenticated
Security boundary impact if the directory listing is served under a trusted application domain

The attack requires the directory listing feature to be enabled and the attacker to control or influence at least one file or directory name in the served path.

Proof of Concept

This proof of concept uses a benign payload.

Create a directory with a file name containing HTML:

mkdir rama-xss-test
cd rama-xss-test
touch '"><img src=x onerror=alert(document.domain)>.txt'

Serve this directory with Rama using ServeDir and DirectoryServeMode::HtmlFileList.

Example intended configuration:

ServeDir::new("rama-xss-test")
    .with_directory_serve_mode(DirectoryServeMode::HtmlFileList)

Then visit the directory listing in a browser.

Expected behavior:

The file name should be displayed as text. Special characters such as <, >, ", and ' should be HTML-escaped.

Actual behavior:

The file name is inserted directly into the generated HTML. The browser interprets the injected HTML and executes the benign JavaScript payload.

Expected Behavior

All file names, directory names, URI path parts, and other untrusted values should be escaped before being inserted into HTML.

For example:

< should become <
> should become >
" should become "
' should become '
& should become &

Untrusted values used inside HTML attributes should be escaped using an attribute-safe escaping function.

Actual Behavior

The directory listing is generated with format!() and inserts file names and path values directly into HTML without escaping.

Suggested Fix

Escape all untrusted values before inserting them into the generated HTML.

Recommended changes:

HTML-escape entry.name before using it as link text.
Attribute-escape values used inside href.
HTML-escape URI path components used in breadcrumbs.
HTML-escape the current path used in the page title and heading.
Add regression tests with file names containing HTML metacharacters.

Example test payloads:

"><img src=x onerror=alert(1)>.txt
<script>alert(1)</script>.txt
a&b.txt
quote"test.txt
single'test.txt

The secure output should render these as text only and should not create executable HTML or JavaScript.

Suggested Severity

Medium.

Suggested CVSS:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Rationale:

The vulnerability is remotely reachable when an application exposes ServeDir directory listings.
Exploitation requires the attacker to create or influence a file or directory name in the served directory.
User interaction is required because a victim must view the affected directory listing.
The impact is browser-side script execution in the application origin.
Scope may change if the listing is served under a trusted authenticated application origin.

Additional Notes

This report is limited to the HTML directory listing generated by ServeDir when DirectoryServeMode::HtmlFileList is enabled.

This report is not claiming remote code execution on the server. The issue is browser-side cross-site scripting caused by unescaped file names and path values in generated HTML.

Fixed in


          0.3.0-rc.1

References

Updated Jul 07, 2026 · Source: OSV.dev

Apr 18, 2025

0.2.0-alpha.11 unknown

1 CVE

GHSA-cwv4-h3j5-w3cf Jul 07, 2026

rama has Stored XSS in ServeDir HTML directory listing via unescaped file names and URI path

3.7 / 10

Low

Local High High Required Changed Low Low None

Resolved: https://github.com/plabayo/rama/commit/89ddff578fd78bbebec99482d7030f28c07757a3

Summary

plabayo/rama contains a stored/reflected cross-site scripting issue in the ServeDir HTML directory listing feature.

When ServeDir is configured with DirectoryServeMode::HtmlFileList, file names and URI path components are inserted directly into generated HTML without HTML escaping. If an attacker can create or influence a file or directory name inside a served directory, they may inject HTML or JavaScript into the directory listing page.

This can execute script in the browser of any user who visits the affected directory listing.

Affected Repository

plabayo/rama

Affected Component

rama-http/src/service/fs/serve_dir/open_file.rs

Root Cause

The HTML directory listing is constructed using string formatting and inserts untrusted values directly into HTML.

The directory listing row includes the file or directory name in both the link text and the href attribute:

rows.push(format!(
    "<tr><td>{5} <a href=\"{1}{2}{0}\">{0}</a></td><td>{3}</td><td>{4}</td></tr>",
    entry.name,
    uri.path().trim_end_matches('/'),
    ...
));

The navigation breadcrumb also inserts URI path parts into generated HTML:

nav_parts.push(format!("<a href=\"{current_path}\">{part}</a>"));

The page title and heading also include the current URI path:

<title>Directory listing for .{0}</title>
<h1>Directory listing for .{0}</h1>

These values are not HTML-escaped before being embedded into the generated page.

Security Impact

If an application uses ServeDir with DirectoryServeMode::HtmlFileList, an attacker who can create or influence file names inside the served directory can inject HTML or JavaScript into the generated directory listing.

Possible impact includes:

Script execution in the browser of users viewing the directory listing
Session or token theft if the application uses cookies or browser-accessible credentials
UI redressing or phishing inside the application origin
Unauthorized actions within the same origin if the victim is authenticated
Security boundary impact if the directory listing is served under a trusted application domain

The attack requires the directory listing feature to be enabled and the attacker to control or influence at least one file or directory name in the served path.

Proof of Concept

This proof of concept uses a benign payload.

Create a directory with a file name containing HTML:

mkdir rama-xss-test
cd rama-xss-test
touch '"><img src=x onerror=alert(document.domain)>.txt'

Serve this directory with Rama using ServeDir and DirectoryServeMode::HtmlFileList.

Example intended configuration:

ServeDir::new("rama-xss-test")
    .with_directory_serve_mode(DirectoryServeMode::HtmlFileList)

Then visit the directory listing in a browser.

Expected behavior:

The file name should be displayed as text. Special characters such as <, >, ", and ' should be HTML-escaped.

Actual behavior:

The file name is inserted directly into the generated HTML. The browser interprets the injected HTML and executes the benign JavaScript payload.

Expected Behavior

All file names, directory names, URI path parts, and other untrusted values should be escaped before being inserted into HTML.

For example:

< should become <
> should become >
" should become "
' should become '
& should become &

Untrusted values used inside HTML attributes should be escaped using an attribute-safe escaping function.

Actual Behavior

The directory listing is generated with format!() and inserts file names and path values directly into HTML without escaping.

Suggested Fix

Escape all untrusted values before inserting them into the generated HTML.

Recommended changes:

HTML-escape entry.name before using it as link text.
Attribute-escape values used inside href.
HTML-escape URI path components used in breadcrumbs.
HTML-escape the current path used in the page title and heading.
Add regression tests with file names containing HTML metacharacters.

Example test payloads:

"><img src=x onerror=alert(1)>.txt
<script>alert(1)</script>.txt
a&b.txt
quote"test.txt
single'test.txt

The secure output should render these as text only and should not create executable HTML or JavaScript.

Suggested Severity

Medium.

Suggested CVSS:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Rationale:

The vulnerability is remotely reachable when an application exposes ServeDir directory listings.
Exploitation requires the attacker to create or influence a file or directory name in the served directory.
User interaction is required because a victim must view the affected directory listing.
The impact is browser-side script execution in the application origin.
Scope may change if the listing is served under a trusted authenticated application origin.

Additional Notes

This report is limited to the HTML directory listing generated by ServeDir when DirectoryServeMode::HtmlFileList is enabled.

This report is not claiming remote code execution on the server. The issue is browser-side cross-site scripting caused by unescaped file names and path values in generated HTML.

Fixed in


          0.3.0-rc.1

References

Updated Jul 07, 2026 · Source: OSV.dev

Apr 16, 2025

0.2.0-alpha.10 unknown

1 CVE

GHSA-cwv4-h3j5-w3cf Jul 07, 2026

rama has Stored XSS in ServeDir HTML directory listing via unescaped file names and URI path

3.7 / 10

Low

Local High High Required Changed Low Low None

Resolved: https://github.com/plabayo/rama/commit/89ddff578fd78bbebec99482d7030f28c07757a3

Summary

plabayo/rama contains a stored/reflected cross-site scripting issue in the ServeDir HTML directory listing feature.

When ServeDir is configured with DirectoryServeMode::HtmlFileList, file names and URI path components are inserted directly into generated HTML without HTML escaping. If an attacker can create or influence a file or directory name inside a served directory, they may inject HTML or JavaScript into the directory listing page.

This can execute script in the browser of any user who visits the affected directory listing.

Affected Repository

plabayo/rama

Affected Component

rama-http/src/service/fs/serve_dir/open_file.rs

Root Cause

The HTML directory listing is constructed using string formatting and inserts untrusted values directly into HTML.

The directory listing row includes the file or directory name in both the link text and the href attribute:

rows.push(format!(
    "<tr><td>{5} <a href=\"{1}{2}{0}\">{0}</a></td><td>{3}</td><td>{4}</td></tr>",
    entry.name,
    uri.path().trim_end_matches('/'),
    ...
));

The navigation breadcrumb also inserts URI path parts into generated HTML:

nav_parts.push(format!("<a href=\"{current_path}\">{part}</a>"));

The page title and heading also include the current URI path:

<title>Directory listing for .{0}</title>
<h1>Directory listing for .{0}</h1>

These values are not HTML-escaped before being embedded into the generated page.

Security Impact

If an application uses ServeDir with DirectoryServeMode::HtmlFileList, an attacker who can create or influence file names inside the served directory can inject HTML or JavaScript into the generated directory listing.

Possible impact includes:

Script execution in the browser of users viewing the directory listing
Session or token theft if the application uses cookies or browser-accessible credentials
UI redressing or phishing inside the application origin
Unauthorized actions within the same origin if the victim is authenticated
Security boundary impact if the directory listing is served under a trusted application domain

The attack requires the directory listing feature to be enabled and the attacker to control or influence at least one file or directory name in the served path.

Proof of Concept

This proof of concept uses a benign payload.

Create a directory with a file name containing HTML:

mkdir rama-xss-test
cd rama-xss-test
touch '"><img src=x onerror=alert(document.domain)>.txt'

Serve this directory with Rama using ServeDir and DirectoryServeMode::HtmlFileList.

Example intended configuration:

ServeDir::new("rama-xss-test")
    .with_directory_serve_mode(DirectoryServeMode::HtmlFileList)

Then visit the directory listing in a browser.

Expected behavior:

The file name should be displayed as text. Special characters such as <, >, ", and ' should be HTML-escaped.

Actual behavior:

The file name is inserted directly into the generated HTML. The browser interprets the injected HTML and executes the benign JavaScript payload.

Expected Behavior

All file names, directory names, URI path parts, and other untrusted values should be escaped before being inserted into HTML.

For example:

< should become <
> should become >
" should become "
' should become '
& should become &

Untrusted values used inside HTML attributes should be escaped using an attribute-safe escaping function.

Actual Behavior

The directory listing is generated with format!() and inserts file names and path values directly into HTML without escaping.

Suggested Fix

Escape all untrusted values before inserting them into the generated HTML.

Recommended changes:

HTML-escape entry.name before using it as link text.
Attribute-escape values used inside href.
HTML-escape URI path components used in breadcrumbs.
HTML-escape the current path used in the page title and heading.
Add regression tests with file names containing HTML metacharacters.

Example test payloads:

"><img src=x onerror=alert(1)>.txt
<script>alert(1)</script>.txt
a&b.txt
quote"test.txt
single'test.txt

The secure output should render these as text only and should not create executable HTML or JavaScript.

Suggested Severity

Medium.

Suggested CVSS:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Rationale:

The vulnerability is remotely reachable when an application exposes ServeDir directory listings.
Exploitation requires the attacker to create or influence a file or directory name in the served directory.
User interaction is required because a victim must view the affected directory listing.
The impact is browser-side script execution in the application origin.
Scope may change if the listing is served under a trusted authenticated application origin.

Additional Notes

This report is limited to the HTML directory listing generated by ServeDir when DirectoryServeMode::HtmlFileList is enabled.

This report is not claiming remote code execution on the server. The issue is browser-side cross-site scripting caused by unescaped file names and path values in generated HTML.

Fixed in


          0.3.0-rc.1

References

Updated Jul 07, 2026 · Source: OSV.dev

Apr 15, 2025

0.2.0-alpha.9 unknown

1 CVE

GHSA-cwv4-h3j5-w3cf Jul 07, 2026

rama has Stored XSS in ServeDir HTML directory listing via unescaped file names and URI path

3.7 / 10

Low

Local High High Required Changed Low Low None

Resolved: https://github.com/plabayo/rama/commit/89ddff578fd78bbebec99482d7030f28c07757a3

Summary

plabayo/rama contains a stored/reflected cross-site scripting issue in the ServeDir HTML directory listing feature.

When ServeDir is configured with DirectoryServeMode::HtmlFileList, file names and URI path components are inserted directly into generated HTML without HTML escaping. If an attacker can create or influence a file or directory name inside a served directory, they may inject HTML or JavaScript into the directory listing page.

This can execute script in the browser of any user who visits the affected directory listing.

Affected Repository

plabayo/rama

Affected Component

rama-http/src/service/fs/serve_dir/open_file.rs

Root Cause

The HTML directory listing is constructed using string formatting and inserts untrusted values directly into HTML.

The directory listing row includes the file or directory name in both the link text and the href attribute:

rows.push(format!(
    "<tr><td>{5} <a href=\"{1}{2}{0}\">{0}</a></td><td>{3}</td><td>{4}</td></tr>",
    entry.name,
    uri.path().trim_end_matches('/'),
    ...
));

The navigation breadcrumb also inserts URI path parts into generated HTML:

nav_parts.push(format!("<a href=\"{current_path}\">{part}</a>"));

The page title and heading also include the current URI path:

<title>Directory listing for .{0}</title>
<h1>Directory listing for .{0}</h1>

These values are not HTML-escaped before being embedded into the generated page.

Security Impact

If an application uses ServeDir with DirectoryServeMode::HtmlFileList, an attacker who can create or influence file names inside the served directory can inject HTML or JavaScript into the generated directory listing.

Possible impact includes:

Script execution in the browser of users viewing the directory listing
Session or token theft if the application uses cookies or browser-accessible credentials
UI redressing or phishing inside the application origin
Unauthorized actions within the same origin if the victim is authenticated
Security boundary impact if the directory listing is served under a trusted application domain

The attack requires the directory listing feature to be enabled and the attacker to control or influence at least one file or directory name in the served path.

Proof of Concept

This proof of concept uses a benign payload.

Create a directory with a file name containing HTML:

mkdir rama-xss-test
cd rama-xss-test
touch '"><img src=x onerror=alert(document.domain)>.txt'

Serve this directory with Rama using ServeDir and DirectoryServeMode::HtmlFileList.

Example intended configuration:

ServeDir::new("rama-xss-test")
    .with_directory_serve_mode(DirectoryServeMode::HtmlFileList)

Then visit the directory listing in a browser.

Expected behavior:

The file name should be displayed as text. Special characters such as <, >, ", and ' should be HTML-escaped.

Actual behavior:

The file name is inserted directly into the generated HTML. The browser interprets the injected HTML and executes the benign JavaScript payload.

Expected Behavior

All file names, directory names, URI path parts, and other untrusted values should be escaped before being inserted into HTML.

For example:

< should become <
> should become >
" should become "
' should become '
& should become &

Untrusted values used inside HTML attributes should be escaped using an attribute-safe escaping function.

Actual Behavior

The directory listing is generated with format!() and inserts file names and path values directly into HTML without escaping.

Suggested Fix

Escape all untrusted values before inserting them into the generated HTML.

Recommended changes:

HTML-escape entry.name before using it as link text.
Attribute-escape values used inside href.
HTML-escape URI path components used in breadcrumbs.
HTML-escape the current path used in the page title and heading.
Add regression tests with file names containing HTML metacharacters.

Example test payloads:

"><img src=x onerror=alert(1)>.txt
<script>alert(1)</script>.txt
a&b.txt
quote"test.txt
single'test.txt

The secure output should render these as text only and should not create executable HTML or JavaScript.

Suggested Severity

Medium.

Suggested CVSS:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Rationale:

The vulnerability is remotely reachable when an application exposes ServeDir directory listings.
Exploitation requires the attacker to create or influence a file or directory name in the served directory.
User interaction is required because a victim must view the affected directory listing.
The impact is browser-side script execution in the application origin.
Scope may change if the listing is served under a trusted authenticated application origin.

Additional Notes

This report is limited to the HTML directory listing generated by ServeDir when DirectoryServeMode::HtmlFileList is enabled.

This report is not claiming remote code execution on the server. The issue is browser-side cross-site scripting caused by unescaped file names and path values in generated HTML.

Fixed in


          0.3.0-rc.1

References

Updated Jul 07, 2026 · Source: OSV.dev

Apr 15, 2025

0.2.0-alpha.8 unknown

1 CVE

GHSA-cwv4-h3j5-w3cf Jul 07, 2026

rama has Stored XSS in ServeDir HTML directory listing via unescaped file names and URI path

3.7 / 10

Low

Local High High Required Changed Low Low None

Resolved: https://github.com/plabayo/rama/commit/89ddff578fd78bbebec99482d7030f28c07757a3

Summary

plabayo/rama contains a stored/reflected cross-site scripting issue in the ServeDir HTML directory listing feature.

When ServeDir is configured with DirectoryServeMode::HtmlFileList, file names and URI path components are inserted directly into generated HTML without HTML escaping. If an attacker can create or influence a file or directory name inside a served directory, they may inject HTML or JavaScript into the directory listing page.

This can execute script in the browser of any user who visits the affected directory listing.

Affected Repository

plabayo/rama

Affected Component

rama-http/src/service/fs/serve_dir/open_file.rs

Root Cause

The HTML directory listing is constructed using string formatting and inserts untrusted values directly into HTML.

The directory listing row includes the file or directory name in both the link text and the href attribute:

rows.push(format!(
    "<tr><td>{5} <a href=\"{1}{2}{0}\">{0}</a></td><td>{3}</td><td>{4}</td></tr>",
    entry.name,
    uri.path().trim_end_matches('/'),
    ...
));

The navigation breadcrumb also inserts URI path parts into generated HTML:

nav_parts.push(format!("<a href=\"{current_path}\">{part}</a>"));

The page title and heading also include the current URI path:

<title>Directory listing for .{0}</title>
<h1>Directory listing for .{0}</h1>

These values are not HTML-escaped before being embedded into the generated page.

Security Impact

If an application uses ServeDir with DirectoryServeMode::HtmlFileList, an attacker who can create or influence file names inside the served directory can inject HTML or JavaScript into the generated directory listing.

Possible impact includes:

Script execution in the browser of users viewing the directory listing
Session or token theft if the application uses cookies or browser-accessible credentials
UI redressing or phishing inside the application origin
Unauthorized actions within the same origin if the victim is authenticated
Security boundary impact if the directory listing is served under a trusted application domain

The attack requires the directory listing feature to be enabled and the attacker to control or influence at least one file or directory name in the served path.

Proof of Concept

This proof of concept uses a benign payload.

Create a directory with a file name containing HTML:

mkdir rama-xss-test
cd rama-xss-test
touch '"><img src=x onerror=alert(document.domain)>.txt'

Serve this directory with Rama using ServeDir and DirectoryServeMode::HtmlFileList.

Example intended configuration:

ServeDir::new("rama-xss-test")
    .with_directory_serve_mode(DirectoryServeMode::HtmlFileList)

Then visit the directory listing in a browser.

Expected behavior:

The file name should be displayed as text. Special characters such as <, >, ", and ' should be HTML-escaped.

Actual behavior:

The file name is inserted directly into the generated HTML. The browser interprets the injected HTML and executes the benign JavaScript payload.

Expected Behavior

All file names, directory names, URI path parts, and other untrusted values should be escaped before being inserted into HTML.

For example:

< should become <
> should become >
" should become "
' should become '
& should become &

Untrusted values used inside HTML attributes should be escaped using an attribute-safe escaping function.

Actual Behavior

The directory listing is generated with format!() and inserts file names and path values directly into HTML without escaping.

Suggested Fix

Escape all untrusted values before inserting them into the generated HTML.

Recommended changes:

HTML-escape entry.name before using it as link text.
Attribute-escape values used inside href.
HTML-escape URI path components used in breadcrumbs.
HTML-escape the current path used in the page title and heading.
Add regression tests with file names containing HTML metacharacters.

Example test payloads:

"><img src=x onerror=alert(1)>.txt
<script>alert(1)</script>.txt
a&b.txt
quote"test.txt
single'test.txt

The secure output should render these as text only and should not create executable HTML or JavaScript.

Suggested Severity

Medium.

Suggested CVSS:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Rationale:

The vulnerability is remotely reachable when an application exposes ServeDir directory listings.
Exploitation requires the attacker to create or influence a file or directory name in the served directory.
User interaction is required because a victim must view the affected directory listing.
The impact is browser-side script execution in the application origin.
Scope may change if the listing is served under a trusted authenticated application origin.

Additional Notes

This report is limited to the HTML directory listing generated by ServeDir when DirectoryServeMode::HtmlFileList is enabled.

This report is not claiming remote code execution on the server. The issue is browser-side cross-site scripting caused by unescaped file names and path values in generated HTML.

Fixed in


          0.3.0-rc.1

References

Updated Jul 07, 2026 · Source: OSV.dev

Apr 10, 2025

0.2.0-alpha.7 unknown

1 CVE

GHSA-cwv4-h3j5-w3cf Jul 07, 2026

rama has Stored XSS in ServeDir HTML directory listing via unescaped file names and URI path

3.7 / 10

Low

Local High High Required Changed Low Low None

Resolved: https://github.com/plabayo/rama/commit/89ddff578fd78bbebec99482d7030f28c07757a3

Summary

plabayo/rama contains a stored/reflected cross-site scripting issue in the ServeDir HTML directory listing feature.

When ServeDir is configured with DirectoryServeMode::HtmlFileList, file names and URI path components are inserted directly into generated HTML without HTML escaping. If an attacker can create or influence a file or directory name inside a served directory, they may inject HTML or JavaScript into the directory listing page.

This can execute script in the browser of any user who visits the affected directory listing.

Affected Repository

plabayo/rama

Affected Component

rama-http/src/service/fs/serve_dir/open_file.rs

Root Cause

The HTML directory listing is constructed using string formatting and inserts untrusted values directly into HTML.

The directory listing row includes the file or directory name in both the link text and the href attribute:

rows.push(format!(
    "<tr><td>{5} <a href=\"{1}{2}{0}\">{0}</a></td><td>{3}</td><td>{4}</td></tr>",
    entry.name,
    uri.path().trim_end_matches('/'),
    ...
));

The navigation breadcrumb also inserts URI path parts into generated HTML:

nav_parts.push(format!("<a href=\"{current_path}\">{part}</a>"));

The page title and heading also include the current URI path:

<title>Directory listing for .{0}</title>
<h1>Directory listing for .{0}</h1>

These values are not HTML-escaped before being embedded into the generated page.

Security Impact

If an application uses ServeDir with DirectoryServeMode::HtmlFileList, an attacker who can create or influence file names inside the served directory can inject HTML or JavaScript into the generated directory listing.

Possible impact includes:

Script execution in the browser of users viewing the directory listing
Session or token theft if the application uses cookies or browser-accessible credentials
UI redressing or phishing inside the application origin
Unauthorized actions within the same origin if the victim is authenticated
Security boundary impact if the directory listing is served under a trusted application domain

The attack requires the directory listing feature to be enabled and the attacker to control or influence at least one file or directory name in the served path.

Proof of Concept

This proof of concept uses a benign payload.

Create a directory with a file name containing HTML:

mkdir rama-xss-test
cd rama-xss-test
touch '"><img src=x onerror=alert(document.domain)>.txt'

Serve this directory with Rama using ServeDir and DirectoryServeMode::HtmlFileList.

Example intended configuration:

ServeDir::new("rama-xss-test")
    .with_directory_serve_mode(DirectoryServeMode::HtmlFileList)

Then visit the directory listing in a browser.

Expected behavior:

The file name should be displayed as text. Special characters such as <, >, ", and ' should be HTML-escaped.

Actual behavior:

The file name is inserted directly into the generated HTML. The browser interprets the injected HTML and executes the benign JavaScript payload.

Expected Behavior

All file names, directory names, URI path parts, and other untrusted values should be escaped before being inserted into HTML.

For example:

< should become <
> should become >
" should become "
' should become '
& should become &

Untrusted values used inside HTML attributes should be escaped using an attribute-safe escaping function.

Actual Behavior

The directory listing is generated with format!() and inserts file names and path values directly into HTML without escaping.

Suggested Fix

Escape all untrusted values before inserting them into the generated HTML.

Recommended changes:

HTML-escape entry.name before using it as link text.
Attribute-escape values used inside href.
HTML-escape URI path components used in breadcrumbs.
HTML-escape the current path used in the page title and heading.
Add regression tests with file names containing HTML metacharacters.

Example test payloads:

"><img src=x onerror=alert(1)>.txt
<script>alert(1)</script>.txt
a&b.txt
quote"test.txt
single'test.txt

The secure output should render these as text only and should not create executable HTML or JavaScript.

Suggested Severity

Medium.

Suggested CVSS:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Rationale:

The vulnerability is remotely reachable when an application exposes ServeDir directory listings.
Exploitation requires the attacker to create or influence a file or directory name in the served directory.
User interaction is required because a victim must view the affected directory listing.
The impact is browser-side script execution in the application origin.
Scope may change if the listing is served under a trusted authenticated application origin.

Additional Notes

This report is limited to the HTML directory listing generated by ServeDir when DirectoryServeMode::HtmlFileList is enabled.

This report is not claiming remote code execution on the server. The issue is browser-side cross-site scripting caused by unescaped file names and path values in generated HTML.

Fixed in


          0.3.0-rc.1

References

Updated Jul 07, 2026 · Source: OSV.dev

Mar 11, 2025

0.2.0-alpha.6 unknown

1 CVE

GHSA-cwv4-h3j5-w3cf Jul 07, 2026

rama has Stored XSS in ServeDir HTML directory listing via unescaped file names and URI path

3.7 / 10

Low

Local High High Required Changed Low Low None

Resolved: https://github.com/plabayo/rama/commit/89ddff578fd78bbebec99482d7030f28c07757a3

Summary

plabayo/rama contains a stored/reflected cross-site scripting issue in the ServeDir HTML directory listing feature.

When ServeDir is configured with DirectoryServeMode::HtmlFileList, file names and URI path components are inserted directly into generated HTML without HTML escaping. If an attacker can create or influence a file or directory name inside a served directory, they may inject HTML or JavaScript into the directory listing page.

This can execute script in the browser of any user who visits the affected directory listing.

Affected Repository

plabayo/rama

Affected Component

rama-http/src/service/fs/serve_dir/open_file.rs

Root Cause

The HTML directory listing is constructed using string formatting and inserts untrusted values directly into HTML.

The directory listing row includes the file or directory name in both the link text and the href attribute:

rows.push(format!(
    "<tr><td>{5} <a href=\"{1}{2}{0}\">{0}</a></td><td>{3}</td><td>{4}</td></tr>",
    entry.name,
    uri.path().trim_end_matches('/'),
    ...
));

The navigation breadcrumb also inserts URI path parts into generated HTML:

nav_parts.push(format!("<a href=\"{current_path}\">{part}</a>"));

The page title and heading also include the current URI path:

<title>Directory listing for .{0}</title>
<h1>Directory listing for .{0}</h1>

These values are not HTML-escaped before being embedded into the generated page.

Security Impact

If an application uses ServeDir with DirectoryServeMode::HtmlFileList, an attacker who can create or influence file names inside the served directory can inject HTML or JavaScript into the generated directory listing.

Possible impact includes:

Script execution in the browser of users viewing the directory listing
Session or token theft if the application uses cookies or browser-accessible credentials
UI redressing or phishing inside the application origin
Unauthorized actions within the same origin if the victim is authenticated
Security boundary impact if the directory listing is served under a trusted application domain

The attack requires the directory listing feature to be enabled and the attacker to control or influence at least one file or directory name in the served path.

Proof of Concept

This proof of concept uses a benign payload.

Create a directory with a file name containing HTML:

mkdir rama-xss-test
cd rama-xss-test
touch '"><img src=x onerror=alert(document.domain)>.txt'

Serve this directory with Rama using ServeDir and DirectoryServeMode::HtmlFileList.

Example intended configuration:

ServeDir::new("rama-xss-test")
    .with_directory_serve_mode(DirectoryServeMode::HtmlFileList)

Then visit the directory listing in a browser.

Expected behavior:

The file name should be displayed as text. Special characters such as <, >, ", and ' should be HTML-escaped.

Actual behavior:

The file name is inserted directly into the generated HTML. The browser interprets the injected HTML and executes the benign JavaScript payload.

Expected Behavior

All file names, directory names, URI path parts, and other untrusted values should be escaped before being inserted into HTML.

For example:

< should become <
> should become >
" should become "
' should become '
& should become &

Untrusted values used inside HTML attributes should be escaped using an attribute-safe escaping function.

Actual Behavior

The directory listing is generated with format!() and inserts file names and path values directly into HTML without escaping.

Suggested Fix

Escape all untrusted values before inserting them into the generated HTML.

Recommended changes:

HTML-escape entry.name before using it as link text.
Attribute-escape values used inside href.
HTML-escape URI path components used in breadcrumbs.
HTML-escape the current path used in the page title and heading.
Add regression tests with file names containing HTML metacharacters.

Example test payloads:

"><img src=x onerror=alert(1)>.txt
<script>alert(1)</script>.txt
a&b.txt
quote"test.txt
single'test.txt

The secure output should render these as text only and should not create executable HTML or JavaScript.

Suggested Severity

Medium.

Suggested CVSS:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Rationale:

The vulnerability is remotely reachable when an application exposes ServeDir directory listings.
Exploitation requires the attacker to create or influence a file or directory name in the served directory.
User interaction is required because a victim must view the affected directory listing.
The impact is browser-side script execution in the application origin.
Scope may change if the listing is served under a trusted authenticated application origin.

Additional Notes

This report is limited to the HTML directory listing generated by ServeDir when DirectoryServeMode::HtmlFileList is enabled.

This report is not claiming remote code execution on the server. The issue is browser-side cross-site scripting caused by unescaped file names and path values in generated HTML.

Fixed in


          0.3.0-rc.1

References

Updated Jul 07, 2026 · Source: OSV.dev

Jan 09, 2025

0.2.0-alpha.5 unknown

1 CVE

GHSA-cwv4-h3j5-w3cf Jul 07, 2026

rama has Stored XSS in ServeDir HTML directory listing via unescaped file names and URI path

3.7 / 10

Low

Local High High Required Changed Low Low None

Resolved: https://github.com/plabayo/rama/commit/89ddff578fd78bbebec99482d7030f28c07757a3

Summary

plabayo/rama contains a stored/reflected cross-site scripting issue in the ServeDir HTML directory listing feature.

When ServeDir is configured with DirectoryServeMode::HtmlFileList, file names and URI path components are inserted directly into generated HTML without HTML escaping. If an attacker can create or influence a file or directory name inside a served directory, they may inject HTML or JavaScript into the directory listing page.

This can execute script in the browser of any user who visits the affected directory listing.

Affected Repository

plabayo/rama

Affected Component

rama-http/src/service/fs/serve_dir/open_file.rs

Root Cause

The HTML directory listing is constructed using string formatting and inserts untrusted values directly into HTML.

The directory listing row includes the file or directory name in both the link text and the href attribute:

rows.push(format!(
    "<tr><td>{5} <a href=\"{1}{2}{0}\">{0}</a></td><td>{3}</td><td>{4}</td></tr>",
    entry.name,
    uri.path().trim_end_matches('/'),
    ...
));

The navigation breadcrumb also inserts URI path parts into generated HTML:

nav_parts.push(format!("<a href=\"{current_path}\">{part}</a>"));

The page title and heading also include the current URI path:

<title>Directory listing for .{0}</title>
<h1>Directory listing for .{0}</h1>

These values are not HTML-escaped before being embedded into the generated page.

Security Impact

If an application uses ServeDir with DirectoryServeMode::HtmlFileList, an attacker who can create or influence file names inside the served directory can inject HTML or JavaScript into the generated directory listing.

Possible impact includes:

Script execution in the browser of users viewing the directory listing
Session or token theft if the application uses cookies or browser-accessible credentials
UI redressing or phishing inside the application origin
Unauthorized actions within the same origin if the victim is authenticated
Security boundary impact if the directory listing is served under a trusted application domain

The attack requires the directory listing feature to be enabled and the attacker to control or influence at least one file or directory name in the served path.

Proof of Concept

This proof of concept uses a benign payload.

Create a directory with a file name containing HTML:

mkdir rama-xss-test
cd rama-xss-test
touch '"><img src=x onerror=alert(document.domain)>.txt'

Serve this directory with Rama using ServeDir and DirectoryServeMode::HtmlFileList.

Example intended configuration:

ServeDir::new("rama-xss-test")
    .with_directory_serve_mode(DirectoryServeMode::HtmlFileList)

Then visit the directory listing in a browser.

Expected behavior:

The file name should be displayed as text. Special characters such as <, >, ", and ' should be HTML-escaped.

Actual behavior:

The file name is inserted directly into the generated HTML. The browser interprets the injected HTML and executes the benign JavaScript payload.

Expected Behavior

All file names, directory names, URI path parts, and other untrusted values should be escaped before being inserted into HTML.

For example:

< should become <
> should become >
" should become "
' should become '
& should become &

Untrusted values used inside HTML attributes should be escaped using an attribute-safe escaping function.

Actual Behavior

The directory listing is generated with format!() and inserts file names and path values directly into HTML without escaping.

Suggested Fix

Escape all untrusted values before inserting them into the generated HTML.

Recommended changes:

HTML-escape entry.name before using it as link text.
Attribute-escape values used inside href.
HTML-escape URI path components used in breadcrumbs.
HTML-escape the current path used in the page title and heading.
Add regression tests with file names containing HTML metacharacters.

Example test payloads:

"><img src=x onerror=alert(1)>.txt
<script>alert(1)</script>.txt
a&b.txt
quote"test.txt
single'test.txt

The secure output should render these as text only and should not create executable HTML or JavaScript.

Suggested Severity

Medium.

Suggested CVSS:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Rationale:

The vulnerability is remotely reachable when an application exposes ServeDir directory listings.
Exploitation requires the attacker to create or influence a file or directory name in the served directory.
User interaction is required because a victim must view the affected directory listing.
The impact is browser-side script execution in the application origin.
Scope may change if the listing is served under a trusted authenticated application origin.

Additional Notes

This report is limited to the HTML directory listing generated by ServeDir when DirectoryServeMode::HtmlFileList is enabled.

This report is not claiming remote code execution on the server. The issue is browser-side cross-site scripting caused by unescaped file names and path values in generated HTML.

Fixed in


          0.3.0-rc.1

References

Updated Jul 07, 2026 · Source: OSV.dev

Jan 05, 2025

0.2.0-alpha.4 unknown

1 CVE

GHSA-cwv4-h3j5-w3cf Jul 07, 2026

rama has Stored XSS in ServeDir HTML directory listing via unescaped file names and URI path

3.7 / 10

Low

Local High High Required Changed Low Low None

Resolved: https://github.com/plabayo/rama/commit/89ddff578fd78bbebec99482d7030f28c07757a3

Summary

plabayo/rama contains a stored/reflected cross-site scripting issue in the ServeDir HTML directory listing feature.

When ServeDir is configured with DirectoryServeMode::HtmlFileList, file names and URI path components are inserted directly into generated HTML without HTML escaping. If an attacker can create or influence a file or directory name inside a served directory, they may inject HTML or JavaScript into the directory listing page.

This can execute script in the browser of any user who visits the affected directory listing.

Affected Repository

plabayo/rama

Affected Component

rama-http/src/service/fs/serve_dir/open_file.rs

Root Cause

The HTML directory listing is constructed using string formatting and inserts untrusted values directly into HTML.

The directory listing row includes the file or directory name in both the link text and the href attribute:

rows.push(format!(
    "<tr><td>{5} <a href=\"{1}{2}{0}\">{0}</a></td><td>{3}</td><td>{4}</td></tr>",
    entry.name,
    uri.path().trim_end_matches('/'),
    ...
));

The navigation breadcrumb also inserts URI path parts into generated HTML:

nav_parts.push(format!("<a href=\"{current_path}\">{part}</a>"));

The page title and heading also include the current URI path:

<title>Directory listing for .{0}</title>
<h1>Directory listing for .{0}</h1>

These values are not HTML-escaped before being embedded into the generated page.

Security Impact

If an application uses ServeDir with DirectoryServeMode::HtmlFileList, an attacker who can create or influence file names inside the served directory can inject HTML or JavaScript into the generated directory listing.

Possible impact includes:

Script execution in the browser of users viewing the directory listing
Session or token theft if the application uses cookies or browser-accessible credentials
UI redressing or phishing inside the application origin
Unauthorized actions within the same origin if the victim is authenticated
Security boundary impact if the directory listing is served under a trusted application domain

The attack requires the directory listing feature to be enabled and the attacker to control or influence at least one file or directory name in the served path.

Proof of Concept

This proof of concept uses a benign payload.

Create a directory with a file name containing HTML:

mkdir rama-xss-test
cd rama-xss-test
touch '"><img src=x onerror=alert(document.domain)>.txt'

Serve this directory with Rama using ServeDir and DirectoryServeMode::HtmlFileList.

Example intended configuration:

ServeDir::new("rama-xss-test")
    .with_directory_serve_mode(DirectoryServeMode::HtmlFileList)

Then visit the directory listing in a browser.

Expected behavior:

The file name should be displayed as text. Special characters such as <, >, ", and ' should be HTML-escaped.

Actual behavior:

The file name is inserted directly into the generated HTML. The browser interprets the injected HTML and executes the benign JavaScript payload.

Expected Behavior

All file names, directory names, URI path parts, and other untrusted values should be escaped before being inserted into HTML.

For example:

< should become <
> should become >
" should become "
' should become '
& should become &

Untrusted values used inside HTML attributes should be escaped using an attribute-safe escaping function.

Actual Behavior

The directory listing is generated with format!() and inserts file names and path values directly into HTML without escaping.

Suggested Fix

Escape all untrusted values before inserting them into the generated HTML.

Recommended changes:

HTML-escape entry.name before using it as link text.
Attribute-escape values used inside href.
HTML-escape URI path components used in breadcrumbs.
HTML-escape the current path used in the page title and heading.
Add regression tests with file names containing HTML metacharacters.

Example test payloads:

"><img src=x onerror=alert(1)>.txt
<script>alert(1)</script>.txt
a&b.txt
quote"test.txt
single'test.txt

The secure output should render these as text only and should not create executable HTML or JavaScript.

Suggested Severity

Medium.

Suggested CVSS:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Rationale:

The vulnerability is remotely reachable when an application exposes ServeDir directory listings.
Exploitation requires the attacker to create or influence a file or directory name in the served directory.
User interaction is required because a victim must view the affected directory listing.
The impact is browser-side script execution in the application origin.
Scope may change if the listing is served under a trusted authenticated application origin.

Additional Notes

This report is limited to the HTML directory listing generated by ServeDir when DirectoryServeMode::HtmlFileList is enabled.

This report is not claiming remote code execution on the server. The issue is browser-side cross-site scripting caused by unescaped file names and path values in generated HTML.

Fixed in


          0.3.0-rc.1

References

Updated Jul 07, 2026 · Source: OSV.dev

Dec 29, 2024

0.2.0-alpha.3 unknown

1 CVE

GHSA-cwv4-h3j5-w3cf Jul 07, 2026

rama has Stored XSS in ServeDir HTML directory listing via unescaped file names and URI path

3.7 / 10

Low

Local High High Required Changed Low Low None

Resolved: https://github.com/plabayo/rama/commit/89ddff578fd78bbebec99482d7030f28c07757a3

Summary

plabayo/rama contains a stored/reflected cross-site scripting issue in the ServeDir HTML directory listing feature.

When ServeDir is configured with DirectoryServeMode::HtmlFileList, file names and URI path components are inserted directly into generated HTML without HTML escaping. If an attacker can create or influence a file or directory name inside a served directory, they may inject HTML or JavaScript into the directory listing page.

This can execute script in the browser of any user who visits the affected directory listing.

Affected Repository

plabayo/rama

Affected Component

rama-http/src/service/fs/serve_dir/open_file.rs

Root Cause

The HTML directory listing is constructed using string formatting and inserts untrusted values directly into HTML.

The directory listing row includes the file or directory name in both the link text and the href attribute:

rows.push(format!(
    "<tr><td>{5} <a href=\"{1}{2}{0}\">{0}</a></td><td>{3}</td><td>{4}</td></tr>",
    entry.name,
    uri.path().trim_end_matches('/'),
    ...
));

The navigation breadcrumb also inserts URI path parts into generated HTML:

nav_parts.push(format!("<a href=\"{current_path}\">{part}</a>"));

The page title and heading also include the current URI path:

<title>Directory listing for .{0}</title>
<h1>Directory listing for .{0}</h1>

These values are not HTML-escaped before being embedded into the generated page.

Security Impact

If an application uses ServeDir with DirectoryServeMode::HtmlFileList, an attacker who can create or influence file names inside the served directory can inject HTML or JavaScript into the generated directory listing.

Possible impact includes:

Script execution in the browser of users viewing the directory listing
Session or token theft if the application uses cookies or browser-accessible credentials
UI redressing or phishing inside the application origin
Unauthorized actions within the same origin if the victim is authenticated
Security boundary impact if the directory listing is served under a trusted application domain

The attack requires the directory listing feature to be enabled and the attacker to control or influence at least one file or directory name in the served path.

Proof of Concept

This proof of concept uses a benign payload.

Create a directory with a file name containing HTML:

mkdir rama-xss-test
cd rama-xss-test
touch '"><img src=x onerror=alert(document.domain)>.txt'

Serve this directory with Rama using ServeDir and DirectoryServeMode::HtmlFileList.

Example intended configuration:

ServeDir::new("rama-xss-test")
    .with_directory_serve_mode(DirectoryServeMode::HtmlFileList)

Then visit the directory listing in a browser.

Expected behavior:

The file name should be displayed as text. Special characters such as <, >, ", and ' should be HTML-escaped.

Actual behavior:

The file name is inserted directly into the generated HTML. The browser interprets the injected HTML and executes the benign JavaScript payload.

Expected Behavior

All file names, directory names, URI path parts, and other untrusted values should be escaped before being inserted into HTML.

For example:

< should become <
> should become >
" should become "
' should become '
& should become &

Untrusted values used inside HTML attributes should be escaped using an attribute-safe escaping function.

Actual Behavior

The directory listing is generated with format!() and inserts file names and path values directly into HTML without escaping.

Suggested Fix

Escape all untrusted values before inserting them into the generated HTML.

Recommended changes:

HTML-escape entry.name before using it as link text.
Attribute-escape values used inside href.
HTML-escape URI path components used in breadcrumbs.
HTML-escape the current path used in the page title and heading.
Add regression tests with file names containing HTML metacharacters.

Example test payloads:

"><img src=x onerror=alert(1)>.txt
<script>alert(1)</script>.txt
a&b.txt
quote"test.txt
single'test.txt

The secure output should render these as text only and should not create executable HTML or JavaScript.

Suggested Severity

Medium.

Suggested CVSS:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Rationale:

The vulnerability is remotely reachable when an application exposes ServeDir directory listings.
Exploitation requires the attacker to create or influence a file or directory name in the served directory.
User interaction is required because a victim must view the affected directory listing.
The impact is browser-side script execution in the application origin.
Scope may change if the listing is served under a trusted authenticated application origin.

Additional Notes

This report is limited to the HTML directory listing generated by ServeDir when DirectoryServeMode::HtmlFileList is enabled.

This report is not claiming remote code execution on the server. The issue is browser-side cross-site scripting caused by unescaped file names and path values in generated HTML.

Fixed in


          0.3.0-rc.1

References

Updated Jul 07, 2026 · Source: OSV.dev

Sep 09, 2024

0.2.0-alpha.2 unknown

1 CVE

GHSA-cwv4-h3j5-w3cf Jul 07, 2026

rama has Stored XSS in ServeDir HTML directory listing via unescaped file names and URI path

3.7 / 10

Low

Local High High Required Changed Low Low None

Resolved: https://github.com/plabayo/rama/commit/89ddff578fd78bbebec99482d7030f28c07757a3

Summary

plabayo/rama contains a stored/reflected cross-site scripting issue in the ServeDir HTML directory listing feature.

When ServeDir is configured with DirectoryServeMode::HtmlFileList, file names and URI path components are inserted directly into generated HTML without HTML escaping. If an attacker can create or influence a file or directory name inside a served directory, they may inject HTML or JavaScript into the directory listing page.

This can execute script in the browser of any user who visits the affected directory listing.

Affected Repository

plabayo/rama

Affected Component

rama-http/src/service/fs/serve_dir/open_file.rs

Root Cause

The HTML directory listing is constructed using string formatting and inserts untrusted values directly into HTML.

The directory listing row includes the file or directory name in both the link text and the href attribute:

rows.push(format!(
    "<tr><td>{5} <a href=\"{1}{2}{0}\">{0}</a></td><td>{3}</td><td>{4}</td></tr>",
    entry.name,
    uri.path().trim_end_matches('/'),
    ...
));

The navigation breadcrumb also inserts URI path parts into generated HTML:

nav_parts.push(format!("<a href=\"{current_path}\">{part}</a>"));

The page title and heading also include the current URI path:

<title>Directory listing for .{0}</title>
<h1>Directory listing for .{0}</h1>

These values are not HTML-escaped before being embedded into the generated page.

Security Impact

If an application uses ServeDir with DirectoryServeMode::HtmlFileList, an attacker who can create or influence file names inside the served directory can inject HTML or JavaScript into the generated directory listing.

Possible impact includes:

Script execution in the browser of users viewing the directory listing
Session or token theft if the application uses cookies or browser-accessible credentials
UI redressing or phishing inside the application origin
Unauthorized actions within the same origin if the victim is authenticated
Security boundary impact if the directory listing is served under a trusted application domain

The attack requires the directory listing feature to be enabled and the attacker to control or influence at least one file or directory name in the served path.

Proof of Concept

This proof of concept uses a benign payload.

Create a directory with a file name containing HTML:

mkdir rama-xss-test
cd rama-xss-test
touch '"><img src=x onerror=alert(document.domain)>.txt'

Serve this directory with Rama using ServeDir and DirectoryServeMode::HtmlFileList.

Example intended configuration:

ServeDir::new("rama-xss-test")
    .with_directory_serve_mode(DirectoryServeMode::HtmlFileList)

Then visit the directory listing in a browser.

Expected behavior:

The file name should be displayed as text. Special characters such as <, >, ", and ' should be HTML-escaped.

Actual behavior:

The file name is inserted directly into the generated HTML. The browser interprets the injected HTML and executes the benign JavaScript payload.

Expected Behavior

All file names, directory names, URI path parts, and other untrusted values should be escaped before being inserted into HTML.

For example:

< should become <
> should become >
" should become "
' should become '
& should become &

Untrusted values used inside HTML attributes should be escaped using an attribute-safe escaping function.

Actual Behavior

The directory listing is generated with format!() and inserts file names and path values directly into HTML without escaping.

Suggested Fix

Escape all untrusted values before inserting them into the generated HTML.

Recommended changes:

HTML-escape entry.name before using it as link text.
Attribute-escape values used inside href.
HTML-escape URI path components used in breadcrumbs.
HTML-escape the current path used in the page title and heading.
Add regression tests with file names containing HTML metacharacters.

Example test payloads:

"><img src=x onerror=alert(1)>.txt
<script>alert(1)</script>.txt
a&b.txt
quote"test.txt
single'test.txt

The secure output should render these as text only and should not create executable HTML or JavaScript.

Suggested Severity

Medium.

Suggested CVSS:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Rationale:

The vulnerability is remotely reachable when an application exposes ServeDir directory listings.
Exploitation requires the attacker to create or influence a file or directory name in the served directory.
User interaction is required because a victim must view the affected directory listing.
The impact is browser-side script execution in the application origin.
Scope may change if the listing is served under a trusted authenticated application origin.

Additional Notes

This report is limited to the HTML directory listing generated by ServeDir when DirectoryServeMode::HtmlFileList is enabled.

This report is not claiming remote code execution on the server. The issue is browser-side cross-site scripting caused by unescaped file names and path values in generated HTML.

Fixed in


          0.3.0-rc.1

References

Updated Jul 07, 2026 · Source: OSV.dev

Sep 05, 2024

0.2.0-alpha.1 unknown

1 CVE

GHSA-cwv4-h3j5-w3cf Jul 07, 2026

rama has Stored XSS in ServeDir HTML directory listing via unescaped file names and URI path

3.7 / 10

Low

Local High High Required Changed Low Low None

Resolved: https://github.com/plabayo/rama/commit/89ddff578fd78bbebec99482d7030f28c07757a3

Summary

plabayo/rama contains a stored/reflected cross-site scripting issue in the ServeDir HTML directory listing feature.

When ServeDir is configured with DirectoryServeMode::HtmlFileList, file names and URI path components are inserted directly into generated HTML without HTML escaping. If an attacker can create or influence a file or directory name inside a served directory, they may inject HTML or JavaScript into the directory listing page.

This can execute script in the browser of any user who visits the affected directory listing.

Affected Repository

plabayo/rama

Affected Component

rama-http/src/service/fs/serve_dir/open_file.rs

Root Cause

The HTML directory listing is constructed using string formatting and inserts untrusted values directly into HTML.

The directory listing row includes the file or directory name in both the link text and the href attribute:

rows.push(format!(
    "<tr><td>{5} <a href=\"{1}{2}{0}\">{0}</a></td><td>{3}</td><td>{4}</td></tr>",
    entry.name,
    uri.path().trim_end_matches('/'),
    ...
));

The navigation breadcrumb also inserts URI path parts into generated HTML:

nav_parts.push(format!("<a href=\"{current_path}\">{part}</a>"));

The page title and heading also include the current URI path:

<title>Directory listing for .{0}</title>
<h1>Directory listing for .{0}</h1>

These values are not HTML-escaped before being embedded into the generated page.

Security Impact

If an application uses ServeDir with DirectoryServeMode::HtmlFileList, an attacker who can create or influence file names inside the served directory can inject HTML or JavaScript into the generated directory listing.

Possible impact includes:

Script execution in the browser of users viewing the directory listing
Session or token theft if the application uses cookies or browser-accessible credentials
UI redressing or phishing inside the application origin
Unauthorized actions within the same origin if the victim is authenticated
Security boundary impact if the directory listing is served under a trusted application domain

The attack requires the directory listing feature to be enabled and the attacker to control or influence at least one file or directory name in the served path.

Proof of Concept

This proof of concept uses a benign payload.

Create a directory with a file name containing HTML:

mkdir rama-xss-test
cd rama-xss-test
touch '"><img src=x onerror=alert(document.domain)>.txt'

Serve this directory with Rama using ServeDir and DirectoryServeMode::HtmlFileList.

Example intended configuration:

ServeDir::new("rama-xss-test")
    .with_directory_serve_mode(DirectoryServeMode::HtmlFileList)

Then visit the directory listing in a browser.

Expected behavior:

The file name should be displayed as text. Special characters such as <, >, ", and ' should be HTML-escaped.

Actual behavior:

The file name is inserted directly into the generated HTML. The browser interprets the injected HTML and executes the benign JavaScript payload.

Expected Behavior

All file names, directory names, URI path parts, and other untrusted values should be escaped before being inserted into HTML.

For example:

< should become <
> should become >
" should become "
' should become '
& should become &

Untrusted values used inside HTML attributes should be escaped using an attribute-safe escaping function.

Actual Behavior

The directory listing is generated with format!() and inserts file names and path values directly into HTML without escaping.

Suggested Fix

Escape all untrusted values before inserting them into the generated HTML.

Recommended changes:

HTML-escape entry.name before using it as link text.
Attribute-escape values used inside href.
HTML-escape URI path components used in breadcrumbs.
HTML-escape the current path used in the page title and heading.
Add regression tests with file names containing HTML metacharacters.

Example test payloads:

"><img src=x onerror=alert(1)>.txt
<script>alert(1)</script>.txt
a&b.txt
quote"test.txt
single'test.txt

The secure output should render these as text only and should not create executable HTML or JavaScript.

Suggested Severity

Medium.

Suggested CVSS:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Rationale:

The vulnerability is remotely reachable when an application exposes ServeDir directory listings.
Exploitation requires the attacker to create or influence a file or directory name in the served directory.
User interaction is required because a victim must view the affected directory listing.
The impact is browser-side script execution in the application origin.
Scope may change if the listing is served under a trusted authenticated application origin.

Additional Notes

This report is limited to the HTML directory listing generated by ServeDir when DirectoryServeMode::HtmlFileList is enabled.

This report is not claiming remote code execution on the server. The issue is browser-side cross-site scripting caused by unescaped file names and path values in generated HTML.

Fixed in


          0.3.0-rc.1

References

Updated Jul 07, 2026 · Source: OSV.dev

Aug 18, 2024

0.2.0-alpha.0 unknown

1 CVE

GHSA-cwv4-h3j5-w3cf Jul 07, 2026

rama has Stored XSS in ServeDir HTML directory listing via unescaped file names and URI path

3.7 / 10

Low

Local High High Required Changed Low Low None

Resolved: https://github.com/plabayo/rama/commit/89ddff578fd78bbebec99482d7030f28c07757a3

Summary

plabayo/rama contains a stored/reflected cross-site scripting issue in the ServeDir HTML directory listing feature.

When ServeDir is configured with DirectoryServeMode::HtmlFileList, file names and URI path components are inserted directly into generated HTML without HTML escaping. If an attacker can create or influence a file or directory name inside a served directory, they may inject HTML or JavaScript into the directory listing page.

This can execute script in the browser of any user who visits the affected directory listing.

Affected Repository

plabayo/rama

Affected Component

rama-http/src/service/fs/serve_dir/open_file.rs

Root Cause

The HTML directory listing is constructed using string formatting and inserts untrusted values directly into HTML.

The directory listing row includes the file or directory name in both the link text and the href attribute:

rows.push(format!(
    "<tr><td>{5} <a href=\"{1}{2}{0}\">{0}</a></td><td>{3}</td><td>{4}</td></tr>",
    entry.name,
    uri.path().trim_end_matches('/'),
    ...
));

The navigation breadcrumb also inserts URI path parts into generated HTML:

nav_parts.push(format!("<a href=\"{current_path}\">{part}</a>"));

The page title and heading also include the current URI path:

<title>Directory listing for .{0}</title>
<h1>Directory listing for .{0}</h1>

These values are not HTML-escaped before being embedded into the generated page.

Security Impact

If an application uses ServeDir with DirectoryServeMode::HtmlFileList, an attacker who can create or influence file names inside the served directory can inject HTML or JavaScript into the generated directory listing.

Possible impact includes:

Script execution in the browser of users viewing the directory listing
Session or token theft if the application uses cookies or browser-accessible credentials
UI redressing or phishing inside the application origin
Unauthorized actions within the same origin if the victim is authenticated
Security boundary impact if the directory listing is served under a trusted application domain

The attack requires the directory listing feature to be enabled and the attacker to control or influence at least one file or directory name in the served path.

Proof of Concept

This proof of concept uses a benign payload.

Create a directory with a file name containing HTML:

mkdir rama-xss-test
cd rama-xss-test
touch '"><img src=x onerror=alert(document.domain)>.txt'

Serve this directory with Rama using ServeDir and DirectoryServeMode::HtmlFileList.

Example intended configuration:

ServeDir::new("rama-xss-test")
    .with_directory_serve_mode(DirectoryServeMode::HtmlFileList)

Then visit the directory listing in a browser.

Expected behavior:

The file name should be displayed as text. Special characters such as <, >, ", and ' should be HTML-escaped.

Actual behavior:

The file name is inserted directly into the generated HTML. The browser interprets the injected HTML and executes the benign JavaScript payload.

Expected Behavior

All file names, directory names, URI path parts, and other untrusted values should be escaped before being inserted into HTML.

For example:

< should become <
> should become >
" should become "
' should become '
& should become &

Untrusted values used inside HTML attributes should be escaped using an attribute-safe escaping function.

Actual Behavior

The directory listing is generated with format!() and inserts file names and path values directly into HTML without escaping.

Suggested Fix

Escape all untrusted values before inserting them into the generated HTML.

Recommended changes:

HTML-escape entry.name before using it as link text.
Attribute-escape values used inside href.
HTML-escape URI path components used in breadcrumbs.
HTML-escape the current path used in the page title and heading.
Add regression tests with file names containing HTML metacharacters.

Example test payloads:

"><img src=x onerror=alert(1)>.txt
<script>alert(1)</script>.txt
a&b.txt
quote"test.txt
single'test.txt

The secure output should render these as text only and should not create executable HTML or JavaScript.

Suggested Severity

Medium.

Suggested CVSS:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Rationale:

The vulnerability is remotely reachable when an application exposes ServeDir directory listings.
Exploitation requires the attacker to create or influence a file or directory name in the served directory.
User interaction is required because a victim must view the affected directory listing.
The impact is browser-side script execution in the application origin.
Scope may change if the listing is served under a trusted authenticated application origin.

Additional Notes

This report is limited to the HTML directory listing generated by ServeDir when DirectoryServeMode::HtmlFileList is enabled.

This report is not claiming remote code execution on the server. The issue is browser-side cross-site scripting caused by unescaped file names and path values in generated HTML.

Fixed in


          0.3.0-rc.1

References

Updated Jul 07, 2026 · Source: OSV.dev

Jun 02, 2024

0.1.0 unknown yanked

1 CVE

GHSA-cwv4-h3j5-w3cf Jul 07, 2026

rama has Stored XSS in ServeDir HTML directory listing via unescaped file names and URI path

3.7 / 10

Low

Local High High Required Changed Low Low None

Resolved: https://github.com/plabayo/rama/commit/89ddff578fd78bbebec99482d7030f28c07757a3

Summary

plabayo/rama contains a stored/reflected cross-site scripting issue in the ServeDir HTML directory listing feature.

When ServeDir is configured with DirectoryServeMode::HtmlFileList, file names and URI path components are inserted directly into generated HTML without HTML escaping. If an attacker can create or influence a file or directory name inside a served directory, they may inject HTML or JavaScript into the directory listing page.

This can execute script in the browser of any user who visits the affected directory listing.

Affected Repository

plabayo/rama

Affected Component

rama-http/src/service/fs/serve_dir/open_file.rs

Root Cause

The HTML directory listing is constructed using string formatting and inserts untrusted values directly into HTML.

The directory listing row includes the file or directory name in both the link text and the href attribute:

rows.push(format!(
    "<tr><td>{5} <a href=\"{1}{2}{0}\">{0}</a></td><td>{3}</td><td>{4}</td></tr>",
    entry.name,
    uri.path().trim_end_matches('/'),
    ...
));

The navigation breadcrumb also inserts URI path parts into generated HTML:

nav_parts.push(format!("<a href=\"{current_path}\">{part}</a>"));

The page title and heading also include the current URI path:

<title>Directory listing for .{0}</title>
<h1>Directory listing for .{0}</h1>

These values are not HTML-escaped before being embedded into the generated page.

Security Impact

If an application uses ServeDir with DirectoryServeMode::HtmlFileList, an attacker who can create or influence file names inside the served directory can inject HTML or JavaScript into the generated directory listing.

Possible impact includes:

Script execution in the browser of users viewing the directory listing
Session or token theft if the application uses cookies or browser-accessible credentials
UI redressing or phishing inside the application origin
Unauthorized actions within the same origin if the victim is authenticated
Security boundary impact if the directory listing is served under a trusted application domain

The attack requires the directory listing feature to be enabled and the attacker to control or influence at least one file or directory name in the served path.

Proof of Concept

This proof of concept uses a benign payload.

Create a directory with a file name containing HTML:

mkdir rama-xss-test
cd rama-xss-test
touch '"><img src=x onerror=alert(document.domain)>.txt'

Serve this directory with Rama using ServeDir and DirectoryServeMode::HtmlFileList.

Example intended configuration:

ServeDir::new("rama-xss-test")
    .with_directory_serve_mode(DirectoryServeMode::HtmlFileList)

Then visit the directory listing in a browser.

Expected behavior:

The file name should be displayed as text. Special characters such as <, >, ", and ' should be HTML-escaped.

Actual behavior:

The file name is inserted directly into the generated HTML. The browser interprets the injected HTML and executes the benign JavaScript payload.

Expected Behavior

All file names, directory names, URI path parts, and other untrusted values should be escaped before being inserted into HTML.

For example:

< should become <
> should become >
" should become "
' should become '
& should become &

Untrusted values used inside HTML attributes should be escaped using an attribute-safe escaping function.

Actual Behavior

The directory listing is generated with format!() and inserts file names and path values directly into HTML without escaping.

Suggested Fix

Escape all untrusted values before inserting them into the generated HTML.

Recommended changes:

HTML-escape entry.name before using it as link text.
Attribute-escape values used inside href.
HTML-escape URI path components used in breadcrumbs.
HTML-escape the current path used in the page title and heading.
Add regression tests with file names containing HTML metacharacters.

Example test payloads:

"><img src=x onerror=alert(1)>.txt
<script>alert(1)</script>.txt
a&b.txt
quote"test.txt
single'test.txt

The secure output should render these as text only and should not create executable HTML or JavaScript.

Suggested Severity

Medium.

Suggested CVSS:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Rationale:

The vulnerability is remotely reachable when an application exposes ServeDir directory listings.
Exploitation requires the attacker to create or influence a file or directory name in the served directory.
User interaction is required because a victim must view the affected directory listing.
The impact is browser-side script execution in the application origin.
Scope may change if the listing is served under a trusted authenticated application origin.

Additional Notes

This report is limited to the HTML directory listing generated by ServeDir when DirectoryServeMode::HtmlFileList is enabled.

This report is not claiming remote code execution on the server. The issue is browser-side cross-site scripting caused by unescaped file names and path values in generated HTML.

Fixed in


          0.3.0-rc.1

References

Updated Jul 07, 2026 · Source: OSV.dev

Sep 21, 2022

Activity

Reach

Details