http://www.djangoproject.com/weblog/2011/feb/08/security/

Django's form system includes form fields and widgets for performing file
uploads; in rendering these fields, the name of the file currently stored
in the field is displayed. In the process of rendering, the filename is
displayed without being escaped, as reported by Trac user "e.generalov".

In many cases this does not result in a cross-site-scripting vulnerability,
as file-storage backends can and are encouraged to (and the default
backends provided with Django do) sanitize the supplied filename according
to their requirements. However, the risk of a vulnerability appearing in a
backend which does not sanitize, or which performs insufficient
sanitization, is such that Django will now automatically escape filenames
in form rendering.