Nextcloud Server is an open source personal cloud server. Nextcloud Server 24.0.0 until 24.0.6 and 25.0.0 until 25.0.4, as well as Nextcloud Enterprise Server 23.0.0 until 23.0.11, 24.0.0 until 24.0.6, and 25.0.0 until 25.0.4, have an information disclosure vulnerability. A user was able to get the full data directory path of the Nextcloud server from an API endpoint. By itself this information is not problematic as it can also be guessed for most common setups, but it could speed up other unknown attacks in the future if the information is known. Nextcloud Server 24.0.6 and 25.0.4 and Nextcloud Enterprise Server 23.0.11, 24.0.6, and 25.0.4 contain patches for this issue. There are no known workarounds.
cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*
8C96D16D-F7EB-4674-A02A-FD5AC82CAC57
23.0.14
23.0.0
cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:*
302FFA48-9204-4112-BF23-6182ED62F193
24.0.10
24.0.0
cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*
3D2D0CEB-437C-4ABA-9915-EFCB776E7ADC
24.0.10
24.0.0
cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:*
282F04F1-B4E4-4DC2-82CA-55DB39A3F373
25.0.4
25.0.0
cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*
E14A1D06-7AB2-40C2-806F-7EE34595DAF7
25.0.4
25.0.0
OR
### ⚠️ This issue respects the following points: ⚠️

- [X] This is a **bug**, not a question or a configuration/webserver/proxy issue.
- [X] This issue is **not** already reported on Github _(I've searched it)_.
- [X] Nextcloud Server **is** up to date. See [Maintenance and Release Schedule](https://github.com/nextcloud/server/wiki/Maintenance-and-Release-Schedule) for supported versions.
- [X] Nextcloud Server **is** running on 64bit capable CPU, PHP and OS.
- [X] I agree to follow Nextcloud's [Code of Conduct](https://nextcloud.com/contribute/code-of-conduct/).

### Bug description

When doing a GET request on `/ocs/v1.php/cloud/user?format=json` the server returns user data, including one containing the full local server path:

```
            "storageLocation": "/home/bohwaz/www/tmp/nextcloud/data/bohwaz",
```

This is not a big security issue (as you need to be logged-in to get that response), but this is data that an attacker shouldn't be able to know easily.

This happens on a brand new install after using the web installer.

### Steps to reproduce

1. Do a GET request on `/ocs/v1.php/cloud/user?format=json`


### Expected behavior

No sensitive information being sent to the client.

### Installation method

Community Web installer on a VPS or web space

### Operating system

Debian/Ubuntu

### PHP engine version

PHP 8.1

### Web server

Other

### Database engine version

SQlite

### Is this bug present after an update or on a fresh install?

_No response_

### Are you using the Nextcloud Server Encryption module?

_No response_

### What user-backends are you using?

- [ ] Default user-backend _(database)_
- [ ] LDAP/ Active Directory
- [ ] SSO - SAML
- [ ] Other

### Configuration report

_No response_

### List of activated Apps

```shell
not important
```


### Nextcloud Signing status

_No response_

### Nextcloud Logs

_No response_

### Additional info

_No response_
[Bug]: the complete server installation path is visible in cloud/user endpoint
This is a GitHub Issue
repo:server
owner:nextcloud
Title : [Bug]: the complete server installation path is visible in cloud/user endpoint
Issue date:

--- start body ---
### ⚠️ This issue respects the following points: ⚠️

- [X] This is a **bug**, not a question or a configuration/webserver/proxy issue.
- [X] This issue is **not** already reported on Github _(I've searched it)_.
- [X] Nextcloud Server **is** up to date. See [Maintenance and Release Schedule](https://github.com/nextcloud/server/wiki/Maintenance-and-Release-Schedule) for supported versions.
- [X] Nextcloud Server **is** running on 64bit capable CPU, PHP and OS.
- [X] I agree to follow Nextcloud's [Code of Conduct](https://nextcloud.com/contribute/code-of-conduct/).

### Bug description

When doing a GET request on `/ocs/v1.php/cloud/user?format=json` the server returns user data, including one containing the full local server path:

```
            "storageLocation": "/home/bohwaz/www/tmp/nextcloud/data/bohwaz",
```

This is not a big security issue (as you need to be logged-in to get that response), but this is data that an attacker shouldn't be able to know easily.

This happens on a brand new install after using the web installer.

### Steps to reproduce

1. Do a GET request on `/ocs/v1.php/cloud/user?format=json`


### Expected behavior

No sensitive information being sent to the client.

### Installation method

Community Web installer on a VPS or web space

### Operating system

Debian/Ubuntu

### PHP engine version

PHP 8.1

### Web server

Other

### Database engine version

SQlite

### Is this bug present after an update or on a fresh install?

_No response_

### Are you using the Nextcloud Server Encryption module?

_No response_

### What user-backends are you using?

- [ ] Default user-backend _(database)_
- [ ] LDAP/ Active Directory
- [ ] SSO - SAML
- [ ] Other

### Configuration report

_No response_

### List of activated Apps

```shell
not important
```


### Nextcloud Signing status

_No response_

### Nextcloud Logs

_No response_

### Additional info

_No response_
--- end body ---

comments :
--- start comments ---

--- end comments ---