From f93306c8194e2bc74741bca3c5cb8116eca8a293 Mon Sep 17 00:00:00 2001
From: Jakob Borg <jakob@kastelo.net>
Date: Tue, 2 Jun 2026 16:54:21 +0200
Subject: [PATCH] fix(gui): properly escape filenames in fancytree

Signed-off-by: Jakob Borg <jakob@kastelo.net>
---
 gui/default/syncthing/core/syncthingController.js | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/gui/default/syncthing/core/syncthingController.js b/gui/default/syncthing/core/syncthingController.js
index 43dd76c3c..f8b388065 100644
--- a/gui/default/syncthing/core/syncthingController.js
+++ b/gui/default/syncthing/core/syncthingController.js
@@ -2997,6 +2997,9 @@ angular.module('syncthing.core')
                             $scope.restoreVersions.tree = $("#restoreTree").fancytree({
                                 extensions: ["table", "filter", "glyph"],
                                 quicksearch: true,
+                                // Node titles are remote-controlled file/path
+                                // components; render them as text, not HTML.
+                                escapeTitles: true,
                                 filter: {
                                     hideExpanders: true,
                                     mode: "hide"