Read about this and thought it worth flagging up. Report details mitigation strategies. Don't use NextCloud myself. Reproducible: Always
Not a bug in www-apps/{next,own}cloud. According to current information, vector is CVE-2019-11043 which we track as bug 698452.