diff --git a/src/Text/Pandoc/MediaBag.hs b/src/Text/Pandoc/MediaBag.hs
index 67839970359d..1a4ea2ba1da8 100644
--- a/src/Text/Pandoc/MediaBag.hs
+++ b/src/Text/Pandoc/MediaBag.hs
@@ -107,9 +107,11 @@ insertMedia fp mbMime contents (MediaBag mediamap)
                   _     -> getMimeTypeDef fp''
   mt = fromMaybe fallback mbMime
   path = maybe fp'' (unEscapeString . uriPath) uri
-  ext = case takeExtension path of
-          '.':e | '%' `notElem` e -> '.':e
-          _ -> maybe "" (\x -> '.':T.unpack x) $ extensionFromMimeType mt
+  ext = case extensionFromMimeType mt of
+             Just e -> '.':T.unpack e
+             Nothing -> case takeExtension path of
+                             '.':e | '%' `notElem` e -> '.':e
+                             _ -> ""
 
 -- | Lookup a media item in a 'MediaBag', returning mime type and contents.
 lookupMedia :: FilePath
diff --git a/test/Tests/MediaBag.hs b/test/Tests/MediaBag.hs
index 4cb4ab807dc6..fbc9eb153194 100644
--- a/test/Tests/MediaBag.hs
+++ b/test/Tests/MediaBag.hs
@@ -29,7 +29,7 @@ tests = [
         assertBool "file in directory is not extracted with original name" exists1
         exists2 <- doesFileExist ("foo" </> "f9d88c3dbe18f6a7f5670e994a947d51216cdf0e.jpg")
         assertBool "file above directory is not extracted with hashed name" exists2
-        exists3 <- doesFileExist ("foo" </> "2a0eaa89f43fada3e6c577beea4f2f8f53ab6a1d.lua")
+        exists3 <- doesFileExist ("foo" </> "2a0eaa89f43fada3e6c577beea4f2f8f53ab6a1d.png")
         exists4 <- doesFileExist "a.lua"
         assertBool "data uri with malicious payload gets written outside of destination dir"
           (exists3 && not exists4)