diff --git a/client/src/views/fields/attachment-multiple.js b/client/src/views/fields/attachment-multiple.js
index 984ca86635..9f88f4ab37 100644
--- a/client/src/views/fields/attachment-multiple.js
+++ b/client/src/views/fields/attachment-multiple.js
@@ -252,6 +252,8 @@ Espo.define('views/fields/attachment-multiple', 'views/fields/base', function (D
         },
 
         getEditPreview: function (name, type, id) {
+            name = Handlebars.Utils.escapeExpression(name);
+
             var preview = name;
 
             switch (type) {
@@ -411,6 +413,8 @@ Espo.define('views/fields/attachment-multiple', 'views/fields/base', function (D
         },
 
         getDetailPreview: function (name, type, id) {
+            name = Handlebars.Utils.escapeExpression(name);
+
             var preview = name;
 
             if (this.isTypeIsImage(type)) {
@@ -433,7 +437,7 @@ Espo.define('views/fields/attachment-multiple', 'views/fields/base', function (D
                         previews.push('<div class="attachment-preview">' + this.getDetailPreview(name, type, id) + '</div>');
                         continue;
                     }
-                    var line = '<div class="attachment-block"><span class="glyphicon glyphicon-paperclip small"></span> <a href="' + this.getDownloadUrl(id) + '" target="_BLANK">' + name + '</a></div>';
+                    var line = '<div class="attachment-block"><span class="glyphicon glyphicon-paperclip small"></span> <a href="' + this.getDownloadUrl(id) + '" target="_BLANK">' + Handlebars.Utils.escapeExpression(name); + '</a></div>';
                     names.push(line);
                 }
                 var string = previews.join('') + names.join('');
diff --git a/client/src/views/fields/file.js b/client/src/views/fields/file.js
index 5e06c8ca53..91d27e5fc8 100644
--- a/client/src/views/fields/file.js
+++ b/client/src/views/fields/file.js
@@ -187,6 +187,7 @@ Espo.define('views/fields/file', 'views/fields/link', function (Dep) {
         },
 
         getDetailPreview: function (name, type, id) {
+            name = Handlebars.Utils.escapeExpression(name);
             var preview = name;
 
             switch (type) {
@@ -199,6 +200,7 @@ Espo.define('views/fields/file', 'views/fields/link', function (Dep) {
         },
 
         getEditPreview: function (name, type, id) {
+            name = Handlebars.Utils.escapeExpression(name);
             var preview = name;
 
             switch (type) {
@@ -226,7 +228,7 @@ Espo.define('views/fields/file', 'views/fields/link', function (Dep) {
                 if (this.showPreview && ~this.previewTypeList.indexOf(type)) {
                     string = '<div class="attachment-preview">' + this.getDetailPreview(name, type, id) + '</div>';
                 } else {
-                    string = '<span class="glyphicon glyphicon-paperclip small"></span> <a href="'+ this.getDownloadUrl(id) +'" target="_BLANK">' + name + '</a>';
+                    string = '<span class="glyphicon glyphicon-paperclip small"></span> <a href="'+ this.getDownloadUrl(id) +'" target="_BLANK">' + Handlebars.Utils.escapeExpression(name) + '</a>';
                 }
                 return string;
             }
@@ -333,6 +335,8 @@ Espo.define('views/fields/file', 'views/fields/link', function (Dep) {
         addAttachmentBox: function (name, type, id) {
             this.$attachment.empty();
 
+            name = Handlebars.Utils.escapeExpression(name);
+
             var self = this;
 
             var removeLink = '<a href="javascript:" class="remove-attachment pull-right"><span class="glyphicon glyphicon-remove"></span></a>';
diff --git a/client/src/views/modals/detail.js b/client/src/views/modals/detail.js
index 51a42431e8..691423ec27 100644
--- a/client/src/views/modals/detail.js
+++ b/client/src/views/modals/detail.js
@@ -185,7 +185,7 @@ Espo.define('views/modals/detail', 'views/modal', function (Dep) {
             this.header = this.getLanguage().translate(scope, 'scopeNames');
 
             if (model.get('name')) {
-                this.header += ' &raquo; ' + model.get('name');
+                this.header += ' &raquo; ' + Handlebars.Utils.escapeExpression(model.get('name'));
             }
             if (!this.fullFormDisabled) {
                 this.header = '<a href="#' + scope + '/view/' + this.id+'" class="action" title="'+this.translate('Full Form')+'" data-action="fullForm">' + this.header + '</a>';