Hi Rovsh,
How can we reproduce this? I just tried creating a form with Form Builder in Orbeon Forms 4.5, added a upload field, saved, published, went to the new page, attached a file with an "&" character in the file name, saved, reopened that data, and could save the attached file just fine. Are you doing something different, or seeing something different?
Alex
--
Follow Orbeon on Twitter: @orbeon
Follow me on Twitter: @avernet