An issue was discovered in Joomla! before 3.9.3. A combination of specific web server configurations in connection with specific file types and browser-side MIME-type sniffing causes an XSS attack vector.