Steps to reproduce the issue

In Joomla 3+ go to com_joomlaupdate ->Upload & Update tab

Select a PNG file, or XML file or any-other-file-type

Expected result

Validation error - its not a zip file.

Actual result

The file is uploaded to the tmp path, renamed and prefixed with 'ju

The file extension and mime type is not validated first.

Then you get a login screen.

Additional comments

Tested Joomla 3.9.19 and Joomla 4 beta 1
Cant think of anyway to exploit this so posting publicly.