diff --git a/sphinx/transforms/post_transforms/images.py b/sphinx/transforms/post_transforms/images.py
index 69a939731..31f1c149a 100644
--- a/sphinx/transforms/post_transforms/images.py
+++ b/sphinx/transforms/post_transforms/images.py
@@ -9,6 +9,7 @@
 """
 
 import os
+import re
 from hashlib import sha1
 from math import ceil
 from typing import Any, Dict, List, Tuple
@@ -27,6 +28,7 @@ from sphinx.util.osutil import ensuredir, movefile
 logger = logging.getLogger(__name__)
 
 MAX_FILENAME_LEN = 32
+CRITICAL_PATH_CHAR_RE = re.compile('[:;<>|*" ]')
 
 
 class BaseImageConverter(SphinxTransform):
@@ -146,6 +148,7 @@ class DataURIExtractor(BaseImageConverter):
 
 def get_filename_for(filename: str, mimetype: str) -> str:
     basename = os.path.basename(filename)
+    basename = re.sub(CRITICAL_PATH_CHAR_RE, "_", basename)
     return os.path.splitext(basename)[0] + get_image_extension(mimetype)