Security issue: File / folder name not being escaped correctly in filebrowser

In your browser with the debug console visible to see javascript output

Have a site and go to the Create -> Files page

Upload an image and then edit it and change the
name: Image<script>console.log('bad name!');</script>one
description: This is Image<script>console.log('bad description!');</script>one description

Create a new folder called:
Folder<script>console.log('bad folder!');</script>one

Go into the new folder and upload another file

Problem 1 you see 'bad folder!' in the console bar

Create a page and add an image block to the page and select the image with bad name

Problem 2 you see 'bad name!' in console bar

Save block and then edit it again

Problem 3 you see 'bad name!' in console bar again

Add the folder block to the page

Problem 4 you see 'bad folder!' in the console bar