Create intermediary variable for query value with leading slashes removed.

app/models/repository.rb

@@ -940,7 +940,9 @@ class Repository
   def search_files_by_name(query, ref)
     return [] if empty? || query.blank?
 
-    args = %W(ls-tree --full-tree -r #{ref || root_ref} --name-status | #{Regexp.escape(query.sub(/^\/*/, ""))})
+    safe_query = query.sub(/^\/*/, "")
+
+    args = %W(ls-tree --full-tree -r #{ref || root_ref} --name-status | #{Regexp.escape(safe_query)})
 
     run_git(args).first.lines.map(&:strip)
   end