diff --git a/apps/files/src/services/WebDavSearch.ts b/apps/files/src/services/WebDavSearch.ts
index feb7f30b35768..294ec880b4862 100644
--- a/apps/files/src/services/WebDavSearch.ts
+++ b/apps/files/src/services/WebDavSearch.ts
@@ -56,7 +56,7 @@ export async function searchNodes(query: string, { dir, signal }: SearchNodesOpt
 		 </d:select>
 		 <d:from>
 			 <d:scope>
-				 <d:href>/files/${user.uid}${dir || ''}</d:href>
+				 <d:href>/files/${user.uid}${dir ? escapeHTML(dir) : ''}</d:href>
 				 <d:depth>infinity</d:depth>
 			 </d:scope>
 		 </d:from>