# Group admins can remove arbitrary data from "data" directory (including admin data)

A group admin could create a user named after an existing data directory (e.g. files_external, appdata_*) then delete it, wiping that directory.

- Payout: hidden
- Severity: high
- Program: Nextcloud
- Found by: leonklingele
- Disclosed: 2019-08-12
- CVE: CVE-2019-15624
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/508493
- Library page: https://bugbountylibrary.com/r/h1%3A508493
- Tags: area:web domain:web impact:data-leak impact:integrity kind:bounty platform:hackerone sev:high technique:source-review vuln:access-control vuln:path-traversal

**Target:** Nextcloud server user management / data directory
**Root cause:** User creation does not check whether data/{uid} already exists as a file or folder, and user deletion recursively removes data/{uid} without verifying it only contains the user's own 'files' directory.
**Steps:**
1. Create a new user and make them admin of an arbitrary group
2. Log in as this new user
3. Create a new user named `files_external`, `appdata_{random-data}`, etc.
4. Delete this user
5. Observe the data/files_external or data/appdata{..} folder is removed
**How found:** Noticed that user uids map directly to directories under data/ and that creation/deletion did not guard against pre-existing directories, then tested with names of known data subdirectories.
**Exploitation:** A group admin creates a user whose uid collides with an existing directory under the data root (files_external, appdata_*), then deletes that user; the deletion routine recursively removes data/{uid}, destroying the pre-existing directory contents.
**Insight:** When usernames map to filesystem paths, test creating users named after existing sibling directories (appdata_*, files_external, cache) and check whether deletion recursively removes the colliding path.