Cannot upload attachments with encryption enabled

[ZebraVogel94349]

How to use GitHub

• Please use the 👍 reaction to show that you are affected by the same issue.
• Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
• Subscribe to receive notifications on status change and new comments.

Describe the bug
I use per-user server-side encryption and am unable to upload attachments to cards. Trying to do so results in an internal server error. The attachments do actually get uploaded to the /Deck directory, but cannot be opened or synced. They get added to the card correctly and can be deleted, but you cannot view the file contents.

To Reproduce
Steps to reproduce the behavior:

1. disable the master key and enable server-side-encryption for per-user encryption
2. create a deck, add a card and add an attachment to the card
3. An "internal server error" message pops up. Upon reloading, the attachments are displayed correctly and can be deleted, but their content is inaccessible.

Expected behavior
Encrypt the uploaded attachment correctly when using per-user server side encryption.

Screenshots

Client details:

• OS: Deck issue appears in any client OS (Tested Windows, Linux Mint and Android)
• Browser: Any (Tested Firefox and Chrome)
• Version: -
• Device: Any

Server details

Operating system: Debian 12

Web server: nginx 1.22.1

Database: MariaDB

PHP version: 8.2.30

Nextcloud version: 33.0.0

Where did you install Nextcloud from: zip file from nextcloud.com

Signing status:

No errors have been found.

List of activated apps:

  - activity: 6.0.0-dev.0
  - admin_audit: 1.23.0
  - bruteforcesettings: 6.0.0-dev.0
  - calendar: 6.2.1
  - cloud_federation_api: 1.17.0
  - comments: 1.23.0
  - contacts: 8.4.0
  - dav: 1.36.0
  - deck: 1.17.0
  - encryption: 2.21.0
  - federatedfilesharing: 1.23.0
  - files: 2.5.0
  - files_accesscontrol: 4.0.0
  - files_downloadlimit: 5.1.0-dev.0
  - files_pdfviewer: 6.0.0-dev.0
  - files_sharing: 1.25.2
  - files_trashbin: 1.23.0
  - files_versions: 1.26.0
  - impersonate: 4.0.0
  - logreader: 6.0.0
  - lookup_server_connector: 1.21.0
  - metadata: 0.23.0
  - notifications: 6.0.0
  - oauth2: 1.21.0
  - password_policy: 5.0.0-dev.0
  - photos: 6.0.0-dev.0
  - privacy: 5.0.0-dev.0
  - profile: 1.2.0
  - provisioning_api: 1.23.0
  - related_resources: 4.0.0-dev.0
  - serverinfo: 5.0.0-dev.0
  - settings: 1.16.0
  - sharebymail: 1.23.0
  - socialsharing_email: 4.0.1
  - text: 7.0.0-dev.3
  - theming: 2.8.0
  - transfer: 0.6.3
  - twofactor_backupcodes: 1.22.0
  - twofactor_nextcloud_notification: 7.0.0
  - twofactor_totp: 15.0.0-dev.0
  - viewer: 6.0.0-dev.0
  - workflowengine: 2.15.0
Disabled:
  - app_api: 33.0.0 (installed 33.0.0)
  - circles: 33.0.0 (installed 33.0.0)
  - contactsinteraction: 1.14.1 (installed 1.14.1)
  - dashboard: 7.13.0 (installed 7.13.0)
  - federation: 1.23.0 (installed 1.23.0)
  - files_external: 1.25.1 (installed 1.25.1)
  - files_reminders: 1.6.0 (installed 1.6.0)
  - firstrunwizard: 6.0.0-dev.0 (installed 6.0.0-dev.0)
  - nextcloud_announcements: 5.0.0 (installed 5.0.0)
  - recommendations: 6.0.0-dev.0 (installed 6.0.0-dev.0)
  - support: 5.0.0 (installed 5.0.0)
  - survey_client: 5.0.0-dev.0 (installed 5.0.0-dev.0)
  - suspicious_login: 11.0.0-dev.0
  - systemtags: 1.23.0 (installed 1.23.0)
  - updatenotification: 1.23.0 (installed 1.23.0)
  - user_ldap: 1.24.0
  - user_status: 1.13.0 (installed 1.13.0)
  - weather_status: 1.13.0 (installed 1.13.0)
  - webhook_listeners: 1.5.0 (installed 1.5.0)

Nextcloud configuration:

{
    "system": {
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "cm.gl"
        ],
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "overwriteprotocol": "https",
        "overwritehost": "cm.gl",
        "overwrite.cli.url": "http:\/\/localhost\/",
        "session_lifetime": 86400,
        "session_keepalive": true,
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "version": "33.0.0.16",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": 6379,
            "timeout": 0
        },
        "filelocking.enabled": true,
        "log_type": "file",
        "logfile": "\/media\/RAID\/Nextcloud\/nextcloud.log",
        "loglevel": 3,
        "maintenance": false,
        "skeletondirectory": "",
        "theme": "",
        "memories.db.triggers.fcu": true,
        "memories.exiftool": "\/var\/www\/nextcloud\/apps\/memories\/bin-ext\/exiftool-amd64-glibc",
        "memories.vod.path": "\/var\/www\/nextcloud\/apps\/memories\/bin-ext\/go-vod-amd64",
        "memories.vod.ffmpeg": "\/usr\/bin\/ffmpeg",
        "memories.vod.ffprobe": "\/usr\/bin\/ffprobe",
        "app_install_overwrite": {
            "1": "transfer",
            "3": "metadata"
        },
        "maintenance_window_start": "3",
        "default_phone_region": "DE",
        "mail_smtpmode": "smtp",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "25",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtptimeout": 30,
        "mail_sendmailmode": "smtp",
        "memories.index.mode": "2",
        "enabledPreviewProviders": [
            "OC\\Preview\\HEIC",
            "OC\\Preview\\Image"
        ],
        "default_language": "de",
        "updater.secret": "***REMOVED SENSITIVE VALUE***",
        "files.chunked_upload.max_size": 10485760
    }
}

Are you using an external user-backend, if yes which one: LDAP/ActiveDirectory/Webdav/...
No

Logs

Nextcloud log (data/nextcloud.log)

{"reqId":"homSsfptkBKa04N5w7wl","level":3,"time":"2026-03-10T23:14:59+00:00","remoteAddr":"192.168.178.45","user":"user","app":"no app in context","method":"GET","url":"/remote.php/dav/files/user/Deck/Uebung%2002%20Di%2009_annotated.pdf","scriptName":"/remote.php","message":"Uncaught exception","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:145.0) Gecko/20100101 Firefox/145.0","version":"33.0.0.16","exception":{"Exception":"TypeError","Message":"OCA\\Deck\\Db\\CardMapper::findBoardId(): Argument #1 ($id) must be of type int, string given, called in /var/www/nextcloud/apps/deck/lib/Sharing/DeckShareProvider.php on line 984","Code":0,"Trace":[{"file":"/var/www/nextcloud/apps/deck/lib/Sharing/DeckShareProvider.php","line":984,"function":"findBoardId","class":"OCA\\Deck\\Db\\CardMapper","type":"->"},{"file":"/var/www/nextcloud/lib/private/Share20/Manager.php","line":1602,"function":"getAccessList","class":"OCA\\Deck\\Sharing\\DeckShareProvider","type":"->"},{"file":"/var/www/nextcloud/lib/private/Encryption/File.php","line":89,"function":"getAccessList","class":"OC\\Share20\\Manager","type":"->"},{"file":"/var/www/nextcloud/lib/private/Files/Stream/Encryption.php","line":226,"function":"getAccessList","class":"OC\\Encryption\\File","type":"->"},{"function":"stream_open","class":"OC\\Files\\Stream\\Encryption","type":"->"},{"file":"/var/www/nextcloud/lib/private/Files/Stream/Encryption.php","line":156,"function":"fopen"},{"file":"/var/www/nextcloud/lib/private/Files/Stream/Encryption.php","line":131,"function":"wrapSource","class":"OC\\Files\\Stream\\Encryption","type":"::"},{"file":"/var/www/nextcloud/lib/private/Files/Storage/Wrapper/Encryption.php","line":363,"function":"wrap","class":"OC\\Files\\Stream\\Encryption","type":"::"},{"file":"/var/www/nextcloud/lib/private/Files/Storage/Wrapper/Wrapper.php","line":144,"function":"fopen","class":"OC\\Files\\Storage\\Wrapper\\Encryption","type":"->"},{"file":"/var/www/nextcloud/apps/files_accesscontrol/lib/StorageWrapper.php","line":236,"function":"fopen","class":"OC\\Files\\Storage\\Wrapper\\Wrapper","type":"->"},{"file":"/var/www/nextcloud/lib/private/Files/View.php","line":1209,"function":"fopen","class":"OCA\\FilesAccessControl\\StorageWrapper","type":"->"},{"file":"/var/www/nextcloud/lib/private/Files/View.php","line":1037,"function":"basicOperation","class":"OC\\Files\\View","type":"->"},{"file":"/var/www/nextcloud/apps/dav/lib/Connector/Sabre/File.php","line":464,"function":"fopen","class":"OC\\Files\\View","type":"->"},{"file":"/var/www/nextcloud/3rdparty/sabre/dav/lib/DAV/CorePlugin.php","line":85,"function":"get","class":"OCA\\DAV\\Connector\\Sabre\\File","type":"->"},{"file":"/var/www/nextcloud/3rdparty/sabre/event/lib/WildcardEmitterTrait.php","line":89,"function":"httpGet","class":"Sabre\\DAV\\CorePlugin","type":"->"},{"file":"/var/www/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php","line":472,"function":"emit","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/var/www/nextcloud/apps/dav/lib/Connector/Sabre/Server.php","line":212,"function":"invokeMethod","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/var/www/nextcloud/apps/dav/lib/Server.php","line":427,"function":"start","class":"OCA\\DAV\\Connector\\Sabre\\Server","type":"->"},{"file":"/var/www/nextcloud/apps/dav/appinfo/v2/remote.php","line":25,"function":"exec","class":"OCA\\DAV\\Server","type":"->"},{"file":"/var/www/nextcloud/remote.php","line":151,"args":["/var/www/nextcloud/apps/dav/appinfo/v2/remote.php"],"function":"require_once"}],"File":"/var/www/nextcloud/apps/deck/lib/Db/CardMapper.php","Line":632,"message":"Uncaught exception","exception":"{\"class\":\"TypeError\",\"message\":\"OCA\\Deck\\Db\\CardMapper::findBoardId(): Argument #1 ($id) must be of type int, string given, called in /var/www/nextcloud/apps/deck/lib/Sharing/DeckShareProvider.php on line 984\",\"code\":0,\"file\":\"/var/www/nextcloud/apps/deck/lib/Db/CardMapper.php:632\",\"trace\":\"#0 /var/www/nextcloud/apps/deck/lib/Sharing/DeckShareProvider.php(984): OCA\\Deck\\Db\\CardMapper->findBoardId()\\n#1 /var/www/nextcloud/lib/private/Share20/Manager.php(1602): OCA\\Deck\\Sharing\\DeckShareProvider->getAccessList()\\n#2 /var/www/nextcloud/lib/private/Encryption/File.php(89): OC\\Share20\\Manager->getAccessList()\\n#3 /var/www/nextcloud/lib/private/Files/Stream/Encryption.php(226): OC\\Encryption\\File->getAccessList()\\n#4 [internal function]: OC\\Files\\Stream\\Encryption->stream_open()\\n#5 /var/www/nextcloud/lib/private/Files/Stream/Encryption.php(156): fopen()\\n#6 /var/www/nextcloud/lib/private/Files/Stream/Encryption.php(131): OC\\Files\\Stream\\Encryption::wrapSource()\\n#7 /var/www/nextcloud/lib/private/Files/Storage/Wrapper/Encryption.php(363): OC\\Files\\Stream\\Encryption::wrap()\\n#8 /var/www/nextcloud/lib/private/Files/Storage/Wrapper/Wrapper.php(144): OC\\Files\\Storage\\Wrapper\\Encryption->fopen()\\n#9 /var/www/nextcloud/apps/files_accesscontrol/lib/StorageWrapper.php(236): OC\\Files\\Storage\\Wrapper\\Wrapper->fopen()\\n#10 /var/www/nextcloud/lib/private/Files/View.php(1209): OCA\\FilesAccessControl\\StorageWrapper->fopen()\\n#11 /var/www/nextcloud/lib/private/Files/View.php(1037): OC\\Files\\View->basicOperation()\\n#12 /var/www/nextcloud/apps/dav/lib/Connector/Sabre/File.php(464): OC\\Files\\View->fopen()\\n#13 /var/www/nextcloud/3rdparty/sabre/dav/lib/DAV/CorePlugin.php(85): OCA\\DAV\\Connector\\Sabre\\File->get()\\n#14 /var/www/nextcloud/3rdparty/sabre/event/lib/WildcardEmitterTrait.php(89): Sabre\\DAV\\CorePlugin->httpGet()\\n#15 /var/www/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php(472): Sabre\\DAV\\Server->emit()\\n#16 /var/www/nextcloud/apps/dav/lib/Connector/Sabre/Server.php(212): Sabre\\DAV\\Server->invokeMethod()\\n#17 /var/www/nextcloud/apps/dav/lib/Server.php(427): OCA\\DAV\\Connector\\Sabre\\Server->start()\\n#18 /var/www/nextcloud/apps/dav/appinfo/v2/remote.php(25): OCA\\DAV\\Server->exec()\\n#19 /var/www/nextcloud/remote.php(151): require_once('...')\\n#20 {main}\"}","CustomMessage":"Uncaught exception"},"id":"69b0a99d32c6b"}
{"reqId":"homSsfptkBKa04N5w7wl","level":3,"time":"2026-03-10T23:14:59+00:00","remoteAddr":"192.168.178.45,"user":"user","app":"webdav","method":"GET","url":"/remote.php/dav/files/user/Deck/Uebung%2002%20Di%2009_annotated.pdf","scriptName":"/remote.php","message":"OCA\\Deck\\Db\\CardMapper::findBoardId(): Argument #1 ($id) must be of type int, string given, called in /var/www/nextcloud/apps/deck/lib/Sharing/DeckShareProvider.php on line 984","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:145.0) Gecko/20100101 Firefox/145.0","version":"33.0.0.16","exception":{"Exception":"TypeError","Message":"OCA\\Deck\\Db\\CardMapper::findBoardId(): Argument #1 ($id) must be of type int, string given, called in /var/www/nextcloud/apps/deck/lib/Sharing/DeckShareProvider.php on line 984","Code":0,"Trace":[{"file":"/var/www/nextcloud/apps/deck/lib/Sharing/DeckShareProvider.php","line":984,"function":"findBoardId","class":"OCA\\Deck\\Db\\CardMapper","type":"->"},{"file":"/var/www/nextcloud/lib/private/Share20/Manager.php","line":1602,"function":"getAccessList","class":"OCA\\Deck\\Sharing\\DeckShareProvider","type":"->"},{"file":"/var/www/nextcloud/lib/private/Encryption/File.php","line":89,"function":"getAccessList","class":"OC\\Share20\\Manager","type":"->"},{"file":"/var/www/nextcloud/lib/private/Files/Stream/Encryption.php","line":226,"function":"getAccessList","class":"OC\\Encryption\\File","type":"->"},{"function":"stream_open","class":"OC\\Files\\Stream\\Encryption","type":"->"},{"file":"/var/www/nextcloud/lib/private/Files/Stream/Encryption.php","line":156,"function":"fopen"},{"file":"/var/www/nextcloud/lib/private/Files/Stream/Encryption.php","line":131,"function":"wrapSource","class":"OC\\Files\\Stream\\Encryption","type":"::"},{"file":"/var/www/nextcloud/lib/private/Files/Storage/Wrapper/Encryption.php","line":363,"function":"wrap","class":"OC\\Files\\Stream\\Encryption","type":"::"},{"file":"/var/www/nextcloud/lib/private/Files/Storage/Wrapper/Wrapper.php","line":144,"function":"fopen","class":"OC\\Files\\Storage\\Wrapper\\Encryption","type":"->"},{"file":"/var/www/nextcloud/apps/files_accesscontrol/lib/StorageWrapper.php","line":236,"function":"fopen","class":"OC\\Files\\Storage\\Wrapper\\Wrapper","type":"->"},{"file":"/var/www/nextcloud/lib/private/Files/View.php","line":1209,"function":"fopen","class":"OCA\\FilesAccessControl\\StorageWrapper","type":"->"},{"file":"/var/www/nextcloud/lib/private/Files/View.php","line":1037,"function":"basicOperation","class":"OC\\Files\\View","type":"->"},{"file":"/var/www/nextcloud/apps/dav/lib/Connector/Sabre/File.php","line":464,"function":"fopen","class":"OC\\Files\\View","type":"->"},{"file":"/var/www/nextcloud/3rdparty/sabre/dav/lib/DAV/CorePlugin.php","line":85,"function":"get","class":"OCA\\DAV\\Connector\\Sabre\\File","type":"->"},{"file":"/var/www/nextcloud/3rdparty/sabre/event/lib/WildcardEmitterTrait.php","line":89,"function":"httpGet","class":"Sabre\\DAV\\CorePlugin","type":"->"},{"file":"/var/www/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php","line":472,"function":"emit","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/var/www/nextcloud/apps/dav/lib/Connector/Sabre/Server.php","line":212,"function":"invokeMethod","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/var/www/nextcloud/apps/dav/lib/Server.php","line":427,"function":"start","class":"OCA\\DAV\\Connector\\Sabre\\Server","type":"->"},{"file":"/var/www/nextcloud/apps/dav/appinfo/v2/remote.php","line":25,"function":"exec","class":"OCA\\DAV\\Server","type":"->"},{"file":"/var/www/nextcloud/remote.php","line":151,"args":["/var/www/nextcloud/apps/dav/appinfo/v2/remote.php"],"function":"require_once"}],"File":"/var/www/nextcloud/apps/deck/lib/Db/CardMapper.php","Line":632,"message":"OCA\\Deck\\Db\\CardMapper::findBoardId(): Argument #1 ($id) must be of type int, string given, called in /var/www/nextcloud/apps/deck/lib/Sharing/DeckShareProvider.php on line 984","exception":"{\"class\":\"TypeError\",\"message\":\"OCA\\Deck\\Db\\CardMapper::findBoardId(): Argument #1 ($id) must be of type int, string given, called in /var/www/nextcloud/apps/deck/lib/Sharing/DeckShareProvider.php on line 984\",\"code\":0,\"file\":\"/var/www/nextcloud/apps/deck/lib/Db/CardMapper.php:632\",\"trace\":\"#0 /var/www/nextcloud/apps/deck/lib/Sharing/DeckShareProvider.php(984): OCA\\Deck\\Db\\CardMapper->findBoardId()\\n#1 /var/www/nextcloud/lib/private/Share20/Manager.php(1602): OCA\\Deck\\Sharing\\DeckShareProvider->getAccessList()\\n#2 /var/www/nextcloud/lib/private/Encryption/File.php(89): OC\\Share20\\Manager->getAccessList()\\n#3 /var/www/nextcloud/lib/private/Files/Stream/Encryption.php(226): OC\\Encryption\\File->getAccessList()\\n#4 [internal function]: OC\\Files\\Stream\\Encryption->stream_open()\\n#5 /var/www/nextcloud/lib/private/Files/Stream/Encryption.php(156): fopen()\\n#6 /var/www/nextcloud/lib/private/Files/Stream/Encryption.php(131): OC\\Files\\Stream\\Encryption::wrapSource()\\n#7 /var/www/nextcloud/lib/private/Files/Storage/Wrapper/Encryption.php(363): OC\\Files\\Stream\\Encryption::wrap()\\n#8 /var/www/nextcloud/lib/private/Files/Storage/Wrapper/Wrapper.php(144): OC\\Files\\Storage\\Wrapper\\Encryption->fopen()\\n#9 /var/www/nextcloud/apps/files_accesscontrol/lib/StorageWrapper.php(236): OC\\Files\\Storage\\Wrapper\\Wrapper->fopen()\\n#10 /var/www/nextcloud/lib/private/Files/View.php(1209): OCA\\FilesAccessControl\\StorageWrapper->fopen()\\n#11 /var/www/nextcloud/lib/private/Files/View.php(1037): OC\\Files\\View->basicOperation()\\n#12 /var/www/nextcloud/apps/dav/lib/Connector/Sabre/File.php(464): OC\\Files\\View->fopen()\\n#13 /var/www/nextcloud/3rdparty/sabre/dav/lib/DAV/CorePlugin.php(85): OCA\\DAV\\Connector\\Sabre\\File->get()\\n#14 /var/www/nextcloud/3rdparty/sabre/event/lib/WildcardEmitterTrait.php(89): Sabre\\DAV\\CorePlugin->httpGet()\\n#15 /var/www/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php(472): Sabre\\DAV\\Server->emit()\\n#16 /var/www/nextcloud/apps/dav/lib/Connector/Sabre/Server.php(212): Sabre\\DAV\\Server->invokeMethod()\\n#17 /var/www/nextcloud/apps/dav/lib/Server.php(427): OCA\\DAV\\Connector\\Sabre\\Server->start()\\n#18 /var/www/nextcloud/apps/dav/appinfo/v2/remote.php(25): OCA\\DAV\\Server->exec()\\n#19 /var/www/nextcloud/remote.php(151): require_once('...')\\n#20 {main}\"}","CustomMessage":"OCA\\Deck\\Db\\CardMapper::findBoardId(): Argument #1 ($id) must be of type int, string given, called in /var/www/nextcloud/apps/deck/lib/Sharing/DeckShareProvider.php on line 984"},"id":"69b0a99d32c8e"}

Browser log

{"status":500,"message":"Internal server error: Please contact the server administrator if this error reappears multiple times, please include the request ID \"3iZtg7IVEMAsHkVLUYtP\" below in your report.","requestId":"3iZtg7IVEMAsHkVLUYtP"}