The content can be accessed with any extension e.g.
http://localhost:8080/magnoliaAuthor/demo-project.zzzzzzzzzzz
or
http://localhost:8080/magnoliaAuthor/demo-project.htmlasdfsd

Due to this fact the security scans can see source code disclosure vulnerability in images or other resources.

Out of the box Magnolia installation should instead check extensions against those registered under config:/server/MIMEMappings and allow only no extension or registered extensions to be used.

To allow for backward compatibility, this behaviour should be configurable.