Ticket #22138: 22138.patch

wp-includes/formatting.php

@@ -3243 +3243 @@
  * @return string
  */
 function wp_basename( $path, $suffix = '' ) {
-        return urldecode( basename( str_replace( '%2F', '/', urlencode( $path ) ), $suffix ) );
+        return urldecode( basename( str_replace( array( '%2F', '%5C' ), '/', urlencode( $path ) ), $suffix ) );
 }
 
 /**