Steps to reproduce:
- Create a file "><img src=1 onerror=alert(1)>.jpg locally (any image will do).
- Go to your user profile, click edit on the avatar, select the image and press upload and select.
- Open the avatar editing again and press the delete button on the image.
- Go to the global menu, click on "Page Index" and click on "Deleted Attachments"
- The deleted attachment is displayed with the full filename.
- An alert is displayed and the filename in the attachment column is not fully displayed.