diff --git a/sites/all/modules/webform/components/file.inc b/sites/all/modules/webform/components/file.inc
index cec9a5a8..c4fda7ae 100644
--- a/sites/all/modules/webform/components/file.inc
+++ b/sites/all/modules/webform/components/file.inc
@@ -448,8 +448,15 @@ function webform_file_allow_access($element) {
   if (!empty($element['#value']['fid'])) {
     $fid = $element['#value']['fid'];
     $_SESSION['webform_files'][$fid] = $fid;
-  }
 
+    // Files that aren't saved into a submission (and may never be - CAPTCHA,
+    // required fields, and other validation functions have not been passed yet)
+    // should not have their location echoed back to the user.
+    if (!empty($element['filename'])) {
+      // $filename is added by file_managed_file_process().
+      $element['filename']['#markup'] = check_plain($element['#file']->filename);
+    }
+  }
   return $element;
 }