diff --git a/htdocs/api/class/api_setup.class.php b/htdocs/api/class/api_setup.class.php
index 97c1cb02c57..fa0a9941a94 100644
--- a/htdocs/api/class/api_setup.class.php
+++ b/htdocs/api/class/api_setup.class.php
@@ -2201,7 +2201,7 @@ class Setup extends DolibarrApi
 						$i++;
 						$out .= '<tr class="oddeven">';
 						$out .= '<td>'.$i.'</td>'."\n";
-						$out .= '<td>'.$file['filename'].'</td>'."\n";
+						$out .= '<td>'.dol_escape_htmltag($file['filename']).'</td>'."\n";
 						$out .= '<td class="center">'.$file['expectedmd5'].'</td>'."\n";
 						$out .= "</tr>\n";
 					}
@@ -2234,7 +2234,7 @@ class Setup extends DolibarrApi
 						$i++;
 						$out .= '<tr class="oddeven">';
 						$out .= '<td>'.$i.'</td>'."\n";
-						$out .= '<td>'.$file['filename'].'</td>'."\n";
+						$out .= '<td>'.dol_escape_htmltag($file['filename']).'</td>'."\n";
 						$out .= '<td class="center">'.$file['expectedmd5'].'</td>'."\n";
 						$out .= '<td class="center">'.$file['md5'].'</td>'."\n";
 						$size = dol_filesize(DOL_DOCUMENT_ROOT.'/'.$file['filename']);
@@ -2280,7 +2280,7 @@ class Setup extends DolibarrApi
 						$i++;
 						$out .= '<tr class="oddeven">';
 						$out .= '<td>'.$i.'</td>'."\n";
-						$out .= '<td>'.$file['filename'].'</td>'."\n";
+						$out .= '<td>'.dol_escape_htmltag($file['filename']).'</td>'."\n";
 						$out .= '<td class="center">'.$file['expectedmd5'].'</td>'."\n";
 						$out .= '<td class="center">'.$file['md5'].'</td>'."\n";
 						$size = dol_filesize(DOL_DOCUMENT_ROOT.'/'.$file['filename']);