Stored XSS path field in scheduled reports setting

The path parameter at Scheduled Actions of Scheduled Report setting is not encoded html, leads to the Administrator user who can edit the setting can xss attack to System Administrator or other Administrator user.