diff --git a/cpan/download.cgi b/cpan/download.cgi
index d24ef4e93..8ae56c12f 100755
--- a/cpan/download.cgi
+++ b/cpan/download.cgi
@@ -219,7 +219,8 @@ foreach $pfile (@pfile) {
 	close(TAR);
 	if ($?) {
 		unlink(@pfile) if ($need_unlink);
-		&install_error(&text('download_etar', "<tt>$tar</tt>"));
+		&install_error(&text('download_etar',
+			"<tt>".&html_escape($tar)."</tt>"));
 		}
 	}
 if (@dirs == 0 || $file{'Makefile.PL'}+$file{'Build.PL'} < @dirs) {