Stored XSS over attachment name in attachwysiwyg

This is not critical yet, since attachment names are cleaned, but once we allow all characters in attachment name this is going to be a problem.