Data Field allows you to create custom fields with multiple values under the default table form. The `file_uri` formatter does not properly escape fi...

Data Field allows you to create custom fields with multiple values under the default table form.

The file_uri formatter does not properly escape filenames when rendering links to uploaded files.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission to upload files into a Data Field file subfield.