Steps to replicate:
Add an attachment
Rename the file to "<iframe onload=alert(1)>.txt"
Copy its remove link and open the link in a new browser window
Everything works normally if you just click the delete button rather than copying the link into a new tab.