If an attacker uploads an html file and then uses the direkt link he is able to perform a XSS attack under the origin of the file server.

Proof of concept:
https://files.veliov.com/cdn/storage/uploadedFiles/rpyqF6xJigQPu5PmR/original/rpyqF6xJigQPu5PmR.html

I think we should at least make developer aware of the thread.
Or is there anything else we can really do apart from forbidding it by default to upload certain filetypes?