[Bug]: Deleting files on a public share leads to HTTP500 in some cases

[MalteP]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

Deleting files on a public share will lead to an HTTP 500 under the circumstance that the initiator of the public link is not the owner of the shared folder.

Steps to reproduce

1. User A shares a folder internally with either a group containing User B or directly with User B
2. User B shares a public link with full permissions for a subfolder of User A's internally shared folder
3. Someone with the public link can now upload a file or download files, but when deleting files, this will lead to an error message / HTTP 500 in the browser console

Expected behavior

Deleting a file should just work, as full permissions are granted

Nextcloud Server version

33

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.3

Web server

Apache (supported)

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

Upgraded to a MAJOR version (ex. 31 to 32)

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

List of activated Apps

Nextcloud Signing status

Nextcloud Logs

{"reqId":"fahpZAT1fEB58G53wGX8","level":3,"time":"2026-04-29T12:58:37+00:00","remoteAddr":"10.2.0.76","user":"--","app":"webdav","method":"DELETE","url":"/public.php/dav/files/TtFtWwFL8ZYo2en/IMG_0616.JPG","scriptName":"/public.php","message":"OC\\Files\\View::getOwner(): Argument #1 ($path) must be of type string, null given, called in /var/www/nextcloud/lib/private/Files/Filesystem.php on line 690","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36 Edg/147.0.0.0","version":"33.0.2.2","exception":{"Exception":"TypeError","Message":"OC\\Files\\View::getOwner(): Argument #1 ($path) must be of type string, null given, called in /var/www/nextcloud/lib/private/Files/Filesystem.php on line 690","Code":0,"Trace":[{"file":"/var/www/nextcloud/lib/private/Files/Filesystem.php","line":690,"function":"getOwner","class":"OC\\Files\\View","type":"->"},{"file":"/var/www/nextcloud/apps/files_versions/lib/Storage.php","line":90,"function":"getOwner","class":"OC\\Files\\Filesystem","type":"::"},{"file":"/var/www/nextcloud/apps/files_versions/lib/Storage.php","line":225,"function":"getUidAndFilename","class":"OCA\\Files_Versions\\Storage","type":"::"},{"file":"/var/www/nextcloud/apps/files_versions/lib/Listener/FileEventsListener.php","line":326,"function":"markDeletedFile","class":"OCA\\Files_Versions\\Storage","type":"::"},{"file":"/var/www/nextcloud/apps/files_versions/lib/Listener/FileEventsListener.php","line":90,"function":"pre_remove_hook","class":"OCA\\Files_Versions\\Listener\\FileEventsListener","type":"->"},{"file":"/var/www/nextcloud/lib/private/EventDispatcher/ServiceEventListener.php","line":57,"function":"handle","class":"OCA\\Files_Versions\\Listener\\FileEventsListener","type":"->"},{"file":"/var/www/nextcloud/3rdparty/symfony/event-dispatcher/EventDispatcher.php","line":220,"function":"__invoke","class":"OC\\EventDispatcher\\ServiceEventListener","type":"->"},{"file":"/var/www/nextcloud/3rdparty/symfony/event-dispatcher/EventDispatcher.php","line":56,"function":"callListeners","class":"Symfony\\Component\\EventDispatcher\\EventDispatcher","type":"->"},{"file":"/var/www/nextcloud/lib/private/EventDispatcher/EventDispatcher.php","line":67,"function":"dispatch","class":"Symfony\\Component\\EventDispatcher\\EventDispatcher","type":"->"},{"file":"/var/www/nextcloud/lib/private/EventDispatcher/EventDispatcher.php","line":79,"function":"dispatch","class":"OC\\EventDispatcher\\EventDispatcher","type":"->"},{"file":"/var/www/nextcloud/lib/private/Files/Node/HookConnector.php","line":112,"function":"dispatchTyped","class":"OC\\EventDispatcher\\EventDispatcher","type":"->"},{"file":"/var/www/nextcloud/lib/private/legacy/OC_Hook.php","line":85,"function":"delete","class":"OC\\Files\\Node\\HookConnector","type":"->"},{"file":"/var/www/nextcloud/lib/private/Files/View.php","line":1323,"function":"emit","class":"OC_Hook","type":"::"},{"file":"/var/www/nextcloud/lib/private/Files/View.php","line":1195,"function":"runHooks","class":"OC\\Files\\View","type":"->"},{"file":"/var/www/nextcloud/lib/private/Files/View.php","line":677,"function":"basicOperation","class":"OC\\Files\\View","type":"->"},{"file":"/var/www/nextcloud/apps/dav/lib/Connector/Sabre/File.php","line":517,"function":"unlink","class":"OC\\Files\\View","type":"->"},{"file":"/var/www/nextcloud/3rdparty/sabre/dav/lib/DAV/Tree.php","line":197,"function":"delete","class":"OCA\\DAV\\Connector\\Sabre\\File","type":"->"},{"file":"/var/www/nextcloud/3rdparty/sabre/dav/lib/DAV/CorePlugin.php","line":281,"function":"delete","class":"Sabre\\DAV\\Tree","type":"->"},{"file":"/var/www/nextcloud/3rdparty/sabre/event/lib/WildcardEmitterTrait.php","line":89,"function":"httpDelete","class":"Sabre\\DAV\\CorePlugin","type":"->"},{"file":"/var/www/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php","line":472,"function":"emit","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/var/www/nextcloud/apps/dav/lib/Connector/Sabre/Server.php","line":212,"function":"invokeMethod","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/var/www/nextcloud/apps/dav/appinfo/v2/publicremote.php","line":164,"function":"start","class":"OCA\\DAV\\Connector\\Sabre\\Server","type":"->"},{"file":"/var/www/nextcloud/public.php","line":90,"args":["/var/www/nextcloud/apps/dav/appinfo/v2/publicremote.php"],"function":"require_once"}],"File":"/var/www/nextcloud/lib/private/Files/View.php","Line":1793,"message":"OC\\Files\\View::getOwner(): Argument #1 ($path) must be of type string, null given, called in /var/www/nextcloud/lib/private/Files/Filesystem.php on line 690","exception":"{\"class\":\"TypeError\",\"message\":\"OC\\Files\\View::getOwner(): Argument #1 ($path) must be of type string, null given, called in /var/www/nextcloud/lib/private/Files/Filesystem.php on line 690\",\"code\":0,\"file\":\"/var/www/nextcloud/lib/private/Files/View.php:1793\",\"trace\":\"#0 /var/www/nextcloud/lib/private/Files/Filesystem.php(690): OC\\Files\\View->getOwner()\\n#1 /var/www/nextcloud/apps/files_versions/lib/Storage.php(90): OC\\Files\\Filesystem::getOwner()\\n#2 /var/www/nextcloud/apps/files_versions/lib/Storage.php(225): OCA\\Files_Versions\\Storage::getUidAndFilename()\\n#3 /var/www/nextcloud/apps/files_versions/lib/Listener/FileEventsListener.php(326): OCA\\Files_Versions\\Storage::markDeletedFile()\\n#4 /var/www/nextcloud/apps/files_versions/lib/Listener/FileEventsListener.php(90): OCA\\Files_Versions\\Listener\\FileEventsListener->pre_remove_hook()\\n#5 /var/www/nextcloud/lib/private/EventDispatcher/ServiceEventListener.php(57): OCA\\Files_Versions\\Listener\\FileEventsListener->handle()\\n#6 /var/www/nextcloud/3rdparty/symfony/event-dispatcher/EventDispatcher.php(220): OC\\EventDispatcher\\ServiceEventListener->__invoke()\\n#7 /var/www/nextcloud/3rdparty/symfony/event-dispatcher/EventDispatcher.php(56): Symfony\\Component\\EventDispatcher\\EventDispatcher->callListeners()\\n#8 /var/www/nextcloud/lib/private/EventDispatcher/EventDispatcher.php(67): Symfony\\Component\\EventDispatcher\\EventDispatcher->dispatch()\\n#9 /var/www/nextcloud/lib/private/EventDispatcher/EventDispatcher.php(79): OC\\EventDispatcher\\EventDispatcher->dispatch()\\n#10 /var/www/nextcloud/lib/private/Files/Node/HookConnector.php(112): OC\\EventDispatcher\\EventDispatcher->dispatchTyped()\\n#11 /var/www/nextcloud/lib/private/legacy/OC_Hook.php(85): OC\\Files\\Node\\HookConnector->delete()\\n#12 /var/www/nextcloud/lib/private/Files/View.php(1323): OC_Hook::emit()\\n#13 /var/www/nextcloud/lib/private/Files/View.php(1195): OC\\Files\\View->runHooks()\\n#14 /var/www/nextcloud/lib/private/Files/View.php(677): OC\\Files\\View->basicOperation()\\n#15 /var/www/nextcloud/apps/dav/lib/Connector/Sabre/File.php(517): OC\\Files\\View->unlink()\\n#16 /var/www/nextcloud/3rdparty/sabre/dav/lib/DAV/Tree.php(197): OCA\\DAV\\Connector\\Sabre\\File->delete()\\n#17 /var/www/nextcloud/3rdparty/sabre/dav/lib/DAV/CorePlugin.php(281): Sabre\\DAV\\Tree->delete()\\n#18 /var/www/nextcloud/3rdparty/sabre/event/lib/WildcardEmitterTrait.php(89): Sabre\\DAV\\CorePlugin->httpDelete()\\n#19 /var/www/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php(472): Sabre\\DAV\\Server->emit()\\n#20 /var/www/nextcloud/apps/dav/lib/Connector/Sabre/Server.php(212): Sabre\\DAV\\Server->invokeMethod()\\n#21 /var/www/nextcloud/apps/dav/appinfo/v2/publicremote.php(164): OCA\\DAV\\Connector\\Sabre\\Server->start()\\n#22 /var/www/nextcloud/public.php(90): require_once('...')\\n#23 {main}\"}","CustomMessage":"OC\\Files\\View::getOwner(): Argument #1 ($path) must be of type string, null given, called in /var/www/nextcloud/lib/private/Files/Filesystem.php on line 690"}}

Additional info

Creating a link that way will lead to a data record inside the oc_share table where uid_owner != uid_initiator

[susnux]

This sounds of a duplicate of #53934
And this specific case is covered by #59252