Fortify flaging .Net6 API returning File from internal server vulnerable to XSS attack

using (HttpClient client = new HttpClient())
{