# Access to all files of remote user through shared file

Copying a WebDAV-shared file in Nextcloud 12 created a folder exposing the sharer's entire home directory structure to the recipient.

- Payout: hidden
- Severity: medium
- Program: Nextcloud
- Found by: xuesheng
- Disclosed: 2020-03-01
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/258084
- Library page: https://bugbountylibrary.com/r/h1%3A258084
- Tags: area:web domain:oss domain:web impact:data-leak impact:internal-access kind:bounty platform:hackerone sev:medium tech:rest technique:legacy-endpoint vuln:access-control vuln:info-disclosure

**Target:** Nextcloud WebDAV file copy of shared file
**Root cause:** WebDAV copy of a shared file resolves the share source path incorrectly, copying the sharer's whole data directory instead of just the shared file.
**Steps:**
1. User A shares `movie.mp4` with user B.
2. User B mounts the share via WebDAV (e.g. foldersync, nautilus); share appears as a regular file.
3. User B copies the file and pastes it into the same folder via WebDAV.
4. A new folder `(1)movie.mp4` appears containing the sharer's full tree: `files`, `files_trashbin`, `cache`, etc.
**How found:** Researcher used a WebDAV client instead of the web UI and noticed the share was presented as a plain file; copying it in place produced an unexpected folder, which on inspection contained the remote user's full data tree.
**Exploitation:** Any share recipient with WebDAV access copies the shared file in place; the resulting folder exposes the sharer's entire home directory contents.
**Insight:** Test share semantics through alternate access paths (WebDAV, sync clients) rather than the web UI; copy/move operations on share mountpoints can resolve to the underlying owner path and leak the whole home directory.