Adobe confirmed that it is a bug and they replied the below in the support ticket.
After I discussed this issue internally, I came to know that there is already a bug created for the engineering team until the engineering team fix this issue, here is the workaround team shared with me which I tested myself:
1. To prevent this issue happening till we get fix from engineering
- Overlay or modify /libs/cq/gui/components/siteadmin/admin/properties/form/form.jsp to not escape the action. Have [B] instead of [A].
2. For thumbnail already uploaded
- Write a small script to move from <pagepath>/jcr:content/image/file.sftmp to <pagepath>/jcr:content/image/file
[A]
vm.put("action", Text.escapePath(contentPath));
[B]
vm.put("action", contentPath);