Upload filenames are already processed via htmlspecialchars in the type_cast_helper of the new request class. There is no need to run it through htmlspecialchars() again in the filespec class. PHPBB3-12211