Environment:

Confluence 6.12.2, Postgre9.5, google chrome.

Steps to replicate

1. Create Confluence page.
2. Add two image attachments to the page - one with .jpg extension and second one .jpeg
3. Save the page. GO to "..." -> attachments. Right click on uploaded attachments -> "Copy link address". Save the links
   Example -

   
   http://<Confluence_base_url>/download/attachments/983045/test.jpg?api=v2
   http://<Confluence_base_url>/download/attachments/983045/test.jpeg?api=v2
   

4. Logout from Confluence.
5. Try to open both urls in the browsers

Expected results

• Attachment is not opened, page is redirected to main Confluence login page
  

Actual results

• jpg attachment url

  http://<Confluence_base_url>/download/attachments/983045/test.jpg?api=v2
  

  is redirected to tomcat HTTP Status 403 page