How to correct security finding message: URL Parameters should be Escaped/Sanitized

We recently scanned all Apex for our org and found multiple security findings with message: URL parameters should be escaped/sanitized XSS. May be tainted: when using variable pageid. Does anyone know what this means? Here is a snippit of code where it is referencing 'pageid' in the page reference var.

id pageid=ApexPages.currentPage().getParameters().get('id');

PageReference ref = new PageReference('/'+pageid);