diff --git a/server/go/camlistored/ui/camli.js b/server/go/camlistored/ui/camli.js
index 8878d5b20..24276c774 100644
--- a/server/go/camlistored/ui/camli.js
+++ b/server/go/camlistored/ui/camli.js
@@ -423,8 +423,8 @@ function _camliBlobTitleOrThumb(pn, des, w, h) {
     if (d.camliType == "file" && d.file && d.file.fileName) {
         var fileName = d.file.fileName
         if (w != 0 && h != 0 && d.file.mimeType && d.file.mimeType.indexOf("image/") == 0) {
-            var img = "<img src='./thumbnail/" + pn + "/" + fileName + 
-            "?mw=" + w + "&mh=" + h + "'>";
+            var img = "<img src='./thumbnail/" + pn + "/" +
+            fileName.replace(/['"<>\?&]/g, "") + "?mw=" + w + "&mh=" + h + "'>";
             return img;
         }
         return fileName;