# Uploading files to a folder where invited user don't have any EDIT privilege

WebDAV COPY action skipped permission checks, letting a read-only share recipient write new files into the shared folder via the Android app.

- Payout: hidden
- Severity: medium
- Program: Nextcloud
- Found by: detroitsmash
- Disclosed: 2016-07-19
- CVE: CVE-2016-9461
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/145950
- Library page: https://bugbountylibrary.com/r/h1%3A145950
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:rest technique:source-review vuln:access-control vuln:auth-bypass

**Target:** WebDAV endpoint (COPY action) on shared folders
**Root cause:** The WebDAV COPY handler did not verify write/edit permission on the destination folder, only on the source, so a read-only share recipient could copy files into it.
**Steps:**
1. Create a folder and share it with a user with no edit privilege.
2. Log in as the invited user via the Nextcloud Android app.
3. Copy any file from the user's root folder into the shared folder using the app's copy feature.
4. Observe in the web app that the copied file now appears in the read-only shared folder.
**How found:** Researcher noticed the Android app's copy feature could place files into a folder where the account had no edit rights, then confirmed the same via the web app.
**Exploitation:** An authenticated user with only read access to a shared folder uses the Android app's copy feature, which issues a WebDAV COPY to the shared folder; the server accepts it and writes the new file, granting unauthorized write capability.
**Insight:** Test every WebDAV verb (COPY, MOVE, MKCOL, PUT) against share permission boundaries, not just PUT; COPY checks source but often forgets destination write permission.