Yes, seems to be a configuration issue, according to

http://doc.otrs.org/2.4/en/html/a2982.html B.1.25.14. AttachmentDownloadType :

"Allows choosing between showing the attachments of a ticket in the browser (inline) or just make them downloadable (attachment)."

Unfortunately, this is still a bit of a risk. Most browsers still do some content sniffing, so what OTRS did with the patch is still the right thing to do. MediaWiki itself has extensive filtering against these types of attacks, by not allowing files that would trigger these attacks to be uploaded. The alternative is to either filter the incoming attachments, or serve them from an alternate domain name.

Thanks for explaining. Decreasing priority again for security reasons, unfortunately.

I would suggest to close this, since it won't be done for security reasons and it is almost certain that this will not be corrected/changed in the future.

Given the age of this request and the recent comments, I'll resolve this task. Please reopen it if you think this still needs to be addressed.