An issue exists in Joomla! 3.0.0 up to and including 3.9.25. Inadequate filters on module layout settings could lead to an LFI.