Executive brief
Rama, a Rust-based web services framework, contains a vulnerability in its directory listing feature. If an attacker can place a file with a specially crafted name into a directory served by the application, they can execute malicious scripts in the browser of any user who views that directory listing. This could lead to unauthorized actions, such as stealing session tokens or redirecting users to malicious websites.
Technical details
A stored XSS vulnerability exists in `rama-http/src/service/fs/serve_dir/open_file.rs` when `ServeDir` is configured with `DirectoryServeMode::HtmlFileList`. The component uses `format!()` to construct HTML directory listings, inserting `entry.name` and URI path components directly into the HTML output without proper encoding. An attacker who can influence file or directory names in the served path can inject arbitrary HTML or JavaScript. The vulnerability is triggered when a user navigates to the affected directory listing. The issue is resolved in version 0.3.0-rc.1 by implementing proper HTML and attribute escaping for all untrusted values.
Affected products
- plabayo rama < 0.3.0-rc.1
Timeline
- 2026-05-31: disclosed
- 2026-05-31: patched: Fixed in commit 89ddff578fd78bbebec99482d7030f28c07757a3
- 2026-07-07: advisory
References
- https://api.github.com/users/chaitanyagarware
- https://github.com/chaitanyagarware
- https://api.github.com/users/chaitanyagarware/gists%7B/gist_id%7D
- https://api.github.com/users/chaitanyagarware/repos
- https://avatars.githubusercontent.com/u/97582002?v=4
- https://api.github.com/users/chaitanyagarware/events%7B/privacy%7D