Dangerous characters in filenames are replaced

Drupal core sanitizes a set of dangerous characters (for example shell metacharacters) in filenames for security reasons; they are replaced by underscores.

Although Drupal core itself handles filenames safely, leaving dangerous characters in filenames increases the risk of contrib or custom code failing to do so and introducing a vulnerability.

Accents, spaces, and most safe unicode characters (e.g. emojis) are preserved in filenames by default; this behavior can be configured in Transliteration settings.

The change also applies only to new file uploads. Existing filenames on the site will not be changed.

Examples:

• a;b|c&d.txt becomes a_b_c_d.txt
• Love&War.pdf becomes Love_War.pdf
• <>|.txt becomes ___.txt
• ---.txt becomes unnamed.txt