diff --git a/apps/files/src/utils/filenameValidity.spec.ts b/apps/files/src/utils/filenameValidity.spec.ts
index 2687956efeb6c..e17a38a9bbbf8 100644
--- a/apps/files/src/utils/filenameValidity.spec.ts
+++ b/apps/files/src/utils/filenameValidity.spec.ts
@@ -10,9 +10,9 @@ vi.mock('@nextcloud/capabilities', () => ({
 	getCapabilities: () => ({
 		files: {
 			forbidden_filename_characters: ['/', '\\', '>'],
-			forbidden_filenames: ['.htaccess'],
+			forbidden_filenames: ['.htaccess', 'a&b'],
 			forbidden_filename_basenames: ['con'],
-			forbidden_filename_extensions: ['.exe', '.~'],
+			forbidden_filename_extensions: ['.exe', '.~', '.a&b'],
 		},
 	}),
 }))
@@ -87,6 +87,14 @@ describe('getFilenameValidity', () => {
 		it('does not escape the matched character by default', () => {
 			expect(getFilenameValidity('inva>lid')).toBe('">" is not allowed inside a filename.')
 		})
+
+		it('escapes a reserved name when requested', () => {
+			expect(getFilenameValidity('a&b', true)).toBe('"a&b" is a reserved name and not allowed for filenames.')
+		})
+
+		it('escapes a forbidden extension when requested', () => {
+			expect(getFilenameValidity('file.a&b', true)).toBe('".a&b" is not an allowed filetype.')
+		})
 	})
 
 	it('rethrows errors that are not InvalidFilenameError', async () => {
diff --git a/apps/files/src/utils/filenameValidity.ts b/apps/files/src/utils/filenameValidity.ts
index b018352a8b272..d114a35ee24e6 100644
--- a/apps/files/src/utils/filenameValidity.ts
+++ b/apps/files/src/utils/filenameValidity.ts
@@ -37,17 +37,17 @@ export function getFilenameValidity(name: string, escape = false, isFolder = fal
 				return t('files', '"{char}" is not allowed inside a filename.', { char: error.segment }, { escape })
 			case InvalidFilenameErrorReason.ReservedName:
 				if (isFolder) {
-					return t('files', '"{segment}" is a reserved name and not allowed for folder names.', { segment: error.segment }, { escape: false })
+					return t('files', '"{segment}" is a reserved name and not allowed for folder names.', { segment: error.segment }, { escape })
 				}
-				return t('files', '"{segment}" is a reserved name and not allowed for filenames.', { segment: error.segment }, { escape: false })
+				return t('files', '"{segment}" is a reserved name and not allowed for filenames.', { segment: error.segment }, { escape })
 			case InvalidFilenameErrorReason.Extension:
 				if (!isFolder && error.segment.match(/\.[a-z]/i)) {
-					return t('files', '"{extension}" is not an allowed filetype.', { extension: error.segment }, { escape: false })
+					return t('files', '"{extension}" is not an allowed filetype.', { extension: error.segment }, { escape })
 				}
 				if (isFolder) {
-					return t('files', 'Folder names must not end with "{extension}".', { extension: error.segment }, { escape: false })
+					return t('files', 'Folder names must not end with "{extension}".', { extension: error.segment }, { escape })
 				}
-				return t('files', 'Filenames must not end with "{extension}".', { extension: error.segment }, { escape: false })
+				return t('files', 'Filenames must not end with "{extension}".', { extension: error.segment }, { escape })
 			default:
 				if (isFolder) {
 					return t('files', 'Invalid folder name.')