Nextcloud disclosed a bug submitted by rullzer: https://hackerone.com/reports/1724021 – Bounty: $150 [Source]