[Bug]: Problems with filenames containing special characters % and #

[egabosh]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

Synchronization of files with % or # in their names works, e.g., from the Linux desktop client.
However, the file cannot then be synchronized to another server or accessed via the Nextcloud web interface.
The error message in the web interface is:
“The requested file is not available.”
In the Linux file system, it is available as normal on both the client and the server.

Steps to reproduce

1. Create files in the Nexcloud Sync directory on the Client for example some testfiles:

client # cd Nextcloud
client # mkdir test
client # cd test
client # echo x >'TEST%PERCENT'
client # echo x >'TEST#HASH'
client # echo x >'TESTTEST'

2. Nextcloud Client syncs them as expected to the Server
3. Can't access the files 'TEST%PERCENT' and 'TEST#HASH' on the Nextcloud interface on the server. Only file TESTTEST works.
4. Files in a shell on the Server is available:

server # cat data/username/files/test/TEST#HASH 
x
server # cat data/username/files/test/TEST%PERCENT 
x
server # cat data/username/files/test/TESTTEST 
x

Expected behavior

Files 'TEST%PERCENT' and 'TEST#HASH' should be available like TESTTEST

Nextcloud Server version

31

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.3

Web server

Apache (supported)

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

Fresh Nextcloud Server install

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{
    "system": {
        "htaccess.RewriteBase": "\/",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "apps_paths": [
            {
                "path": "\/var\/www\/html\/apps",
                "url": "\/apps",
                "writable": false
            },
            {
                "path": "\/var\/www\/html\/custom_apps",
                "url": "\/custom_apps",
                "writable": true
            }
        ],
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "password": "***REMOVED SENSITIVE VALUE***",
            "port": 6379
        },
        "mail_smtpmode": "smtp",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "465",
        "mail_smtptimeout": 30,
        "mail_smtpsecure": "ssl",
        "mail_smtpauth": true,
        "mail_smtpauthtype": "PLAIN",
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "loglevel": 1,
        "logtimezone": "Europe\/Berlin",
        "log_rotate_size": 10485760,
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "localhost",
            "***REMOVED SENSITIVE VALUE***"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "version": "31.0.12.3",
        "overwrite.cli.url": "https:\/\/localhost",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "twofactor_enforced": "false",
        "twofactor_enforced_groups": [],
        "twofactor_enforced_excluded_groups": [],
        "maintenance": false,
        "mail_sendmailmode": "smtp",
        "default_phone_region": "DE",
        "session_lifetime": 28800,
        "session_keepalive": true,
        "overwriteprotocol": "https",
        "skeletondirectory": "",
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "theme": "",
        "app_install_overwrite": [
            "news"
        ]
    }
}

List of activated Apps

Enabled:
  - activity: 4.0.0
  - admin_audit: 1.21.0
  - app_api: 5.0.2
  - bookmarks: 15.2.1
  - bruteforcesettings: 4.0.0
  - calendar: 5.5.11
  - circles: 31.0.0
  - cloud_federation_api: 1.14.0
  - comments: 1.21.0
  - contacts: 7.3.9
  - contactsinteraction: 1.12.1
  - dav: 1.33.0
  - federatedfilesharing: 1.21.0
  - federation: 1.21.0
  - files: 2.3.1
  - files_downloadlimit: 4.0.0
  - files_external: 1.23.0
  - files_pdfviewer: 4.0.0
  - files_reminders: 1.4.0
  - files_sharing: 1.23.2
  - files_trashbin: 1.21.0
  - files_versions: 1.24.0
  - firstrunwizard: 4.0.0
  - gpoddersync: 3.13.3
  - logreader: 4.0.0
  - lookup_server_connector: 1.19.0
  - news: 27.2.0
  - notes: 4.12.4
  - notifications: 4.0.0
  - oauth2: 1.19.1
  - password_policy: 3.0.0
  - passwords: 2025.12.11
  - phonetrack: 0.9.1
  - photos: 4.0.0
  - privacy: 3.0.0
  - profile: 1.0.0
  - provisioning_api: 1.21.0
  - recommendations: 4.0.0
  - related_resources: 2.0.0
  - settings: 1.14.0
  - sharebymail: 1.21.0
  - survey_client: 3.0.0
  - systemtags: 1.21.1
  - tasks: 0.17.1
  - text: 5.0.2
  - theming: 2.6.1
  - twofactor_backupcodes: 1.20.0
  - twofactor_totp: 13.0.0-dev.0
  - uppush: 2.3.1
  - user_status: 1.11.0
  - viewer: 4.0.0
  - webhook_listeners: 1.2.0
  - workflowengine: 2.13.0
Disabled:
  - dashboard: 7.11.0 (installed 7.4.0)
  - encryption: 2.19.0
  - files_rightclick: 0.15.1 (installed 1.6.0)
  - impersonate: 2.0.0 (installed 2.0.0)
  - maps: 1.6.0 (installed 1.6.0)
  - nextcloud_announcements: 3.0.0 (installed 1.13.0)
  - serverinfo: 3.0.0 (installed 1.14.0)
  - spreed: 21.1.7 (installed 21.1.7)
  - support: 3.0.0 (installed 1.7.0)
  - suspicious_login: 9.0.1
  - twofactor_nextcloud_notification: 5.0.0
  - updatenotification: 1.21.0 (installed 1.14.0)
  - user_ldap: 1.22.0
  - weather_status: 1.11.0 (installed 1.3.0)

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

Nothing in nextcloud.log

Additional info

Access from Android Client to the files with # or % does not work too.
Filesystem on server: ext4

[joshtrichards]

Do you have a WAF like mod_security, CrowdSec, or Cloudflare in front?

[egabosh]

No. Using traefik as reverse proxy.

[joshtrichards]

It appears you're using the micro-services Docker image: please check the container log (the Apache log is redirected there), to determine if the requests are reaching Nextcloud.

Also check your reverse proxy logs.

We need to make sure we're looking in the right place.

It's weird that Desktop would work, but not the Web client (unless their is an encoding issue on the Web client code path; but that doesn't explain Android). They're all WebDAV underneath.

[egabosh]

No output in docker logs when I click on the file in nextclouds web interface.
Either in the nextcloud container nor in the traefik container.

[joshtrichards]

Traefik recently had a vulnerability that they patched by blocking characters and changing what's permitted to be encoded (by default). I believe # is on that list. Check their release notes and your version.

Any chance your Linux client bypasses your proxy (i.e. it's local to your Nextcloud instance) or something like that?

If there is nothing in the Nextcloud Apache container log, that suggests it's likely not a bug within Nextcloud.

[egabosh]

Maybe this helps:

client# curl -u "$user:$pass" -X PROPFIND -H "Depth: 1"  "https://server/remote.php/dav/files/olli/test/"
<?xml version="1.0"?>
<d:multistatus xmlns:d="DAV:" xmlns:s="http://sabredav.org/ns" xmlns:oc="http://owncloud.org/ns" xmlns:nc="http://nextcloud.org/ns"><d:response><d:href>/remote.php/dav/files/olli/test/</d:href><d:propstat><d:prop><d:getlastmodified>Mon, 05 Jan 2026 20:05:41 GMT</d:getlastmodified><d:resourcetype><d:collection/></d:resourcetype><d:quota-used-bytes>6</d:quota-used-bytes><d:quota-available-bytes>113952287374</d:quota-available-bytes><d:getetag>&quot;695c19952f440&quot;</d:getetag></d:prop><d:status>HTTP/1.1 200 OK</d:status></d:propstat></d:response><d:response><d:href>/remote.php/dav/files/olli/test/TEST%23HASH</d:href><d:propstat><d:prop><d:getlastmodified>Mon, 05 Jan 2026 20:04:28 GMT</d:getlastmodified><d:getcontentlength>2</d:getcontentlength><d:resourcetype/><d:getetag>&quot;9f753211f4d0e71b7da379214f73be32&quot;</d:getetag><d:getcontenttype>application/octet-stream</d:getcontenttype></d:prop><d:status>HTTP/1.1 200 OK</d:status></d:propstat></d:response><d:response><d:href>/remote.php/dav/files/olli/test/TEST%25PERCENT</d:href><d:propstat><d:prop><d:getlastmodified>Mon, 05 Jan 2026 20:04:20 GMT</d:getlastmodified><d:getcontentlength>2</d:getcontentlength><d:resourcetype/><d:getetag>&quot;81d9fe08128bc3dfb5b8cb96396c2b1a&quot;</d:getetag><d:getcontenttype>application/octet-stream</d:getcontenttype></d:prop><d:status>HTTP/1.1 200 OK</d:status></d:propstat></d:response><d:response><d:href>/remote.php/dav/files/olli/test/TESTTEST</d:href><d:propstat><d:prop><d:getlastmodified>Mon, 05 Jan 2026 20:05:36 GMT</d:getlastmodified><d:getcontentlength>2</d:getcontentlength><d:resourcetype/><d:getetag>&quot;32918fe91283b0bcbc41eeb396a503c7&quot;</d:getetag><d:getcontenttype>application/octet-stream</d:getcontenttype></d:prop><d:status>HTTP/1.1 200 OK</d:status></d:propstat></d:response></d:multistatus>
client#  echo $?
0
client#  curl -u "$user:$pass" -X GET "https://server/remote.php/dav/files/olli/test/TEST%25PERCENT"
client#  echo $?
0
client#  curl -u "$user:$pass" -X GET "https://server/remote.php/dav/files/olli/test/TEST%23HASH"
client#  echo $?
0
client#  curl -u "$user:$pass" -X GET "https://server/remote.php/dav/files/olli/test/TESTTEST"
x
client#  echo $?
0

[egabosh]

Traefik recently had a vulnerability that they patched by blocking characters and changing what's permitted to be encoded (by default). I believe # is on that list. Check their release notes and your version.

Any chance your Linux client bypasses your proxy (i.e. it's local to your Nextcloud instance) or something like that?

If there is nothing in the Nextcloud Apache container log, that suggests it's likely not a bug within Nextcloud.

Woh, looks you are right! In a shell in my nextcloud container it works:

# curl -u "$user:$pass" -X GET "http://localhost/remote.php/dav/files/olli/test/TEST%25PERCENT"
x

OK, so everyone who uses traefik with nextcloud in a newer versions seems to have the problem and its not a problem with nextcloud!

Thanks a lot for your assistance!

[egabosh]

Hmm... So is this a real/relevant security issue to use encodings like %25 or %23?
Should this be changed in Nextcloud or is it save to deactivate this security feature of traefik?

[joshtrichards]

It may be a security issue if you have an application behind Traefik that isn't RFC compliant and handles the targeted scenario insecurely.

It's a little strange (IMO) that Traefik opted for this approach, since: (a) it's not a security vulnerability in Traefik per se; (b) it's not configurable per route/app so the environments that need this may not be able to use it without simultaneously breaking compliant apps behind the same RP; (c) it's now a default apparently so requires opting out in order to operate in an RFC compliant manner.

I think they meant well, but, no, not using encodings in Nextcloud paths is not the answer. There's nothing wrong with using them.

traefik/traefik#12360