Nextcloud: Cross-User Lock/Unlock via Absolute DAV Path

A vulnerability was discovered in the fileslock app for Nextcloud. The vulnerability allowed any authenticated user to lock or unlock files they did not own by targeting absolute WebDAV paths of other users. This was possible because the DAV plugin resolved files from the absolute request URI...