Only direct calls of this files are vulnerable, while a successful exploitation is indeed very unlikely - but possible - this should get fixed. 

Easiest way would be to ensure that the content-type is set to `text/plain`