[Bug]: Encrypted files become corrupted after restoring a version

[MasamitsuEndo]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

When a file has multiple versions, simply switching back and forth between a few of them causes the file to become corrupted.

This appears to occur when server-side encryption is combined with the versioning app.

We have confirmed a similar issue in Nextcloud 33.0.5 and 30.0.17.

Steps to reproduce

For example, with a file that has two versions, the file becomes corrupted and can no longer be downloaded after just four version rollbacks: Ver2 > Ver1 > Ver2 > Ver1 > Ver2.

This situation is similar to the following issue, but it may be slightly different.
#49125

Expected behavior

Even after restoring a version, the files do not become corrupted, nor do they become undownloadable.

Nextcloud Server version

33

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.4

Web server

Nginx

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

None

Are you using the Nextcloud Server Encryption module?

Encryption is Enabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{
    "system": {
        "logtimezone": "Asia\/Tokyo",
        "maintenance_window_start": 16,
        "default_language": "ja",
        "default_locale": "ja_JP",
        "default_phone_region": "JP",
        "default_app": "dashboard,files",
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "tempdirectory": "\/home\/nextcloud\/data\/temp",
        "log_type": "file",
        "logfile": "\/var\/log\/nextcloud\/nextcloud.log",
        "log_type_audit": "file",
        "logfile_audit": "\/var\/log\/nextcloud\/audit.log",
        "logdateformat": "Y-m-d H:i:s",
        "loglevel": 2,
        "log_rotate_size": 0,
        "log.condition": {
            "apps": [
                "admin_audit"
            ]
        },
        "has_internet_connection": true,
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "filelocking.enabled": "true",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": 6379,
            "timeout": 0,
            "password": "***REMOVED SENSITIVE VALUE***"
        },
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "***REMOVED SENSITIVE VALUE***"
        ],
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "version": "33.0.5.1",
        "overwrite.cli.url": "https:\/\/nc33.nextcloud.biz",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "maintenance": false,
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpmode": "smtp",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpauth": true,
        "mail_smtpport": "587",
        "mail_sendmailmode": "smtp",
        "mail_smtpstreamoptions": {
            "ssl": {
                "allow_self_signed": false,
                "verify_peer": true,
                "verify_peer_name": true
            }
        },
        "defaultapp": "dashboard,files",
        "app_install_overwrite": [],
        "theme": "",
        "serverid": 10
    }
}

List of activated Apps

Enabled:
  - activity: 6.0.0
  - admin_audit: 1.23.0
  - bruteforcesettings: 6.0.0
  - calendar: 6.5.0
  - circles: 33.0.0
  - cloud_federation_api: 1.17.0
  - comments: 1.23.0
  - contacts: 8.7.1
  - contactsinteraction: 1.14.1
  - dashboard: 7.13.0
  - dav: 1.36.0
  - encryption: 2.21.0
  - federatedfilesharing: 1.23.0
  - federation: 1.23.0
  - files: 2.5.0
  - files_accesscontrol: 4.0.1
  - files_automatedtagging: 4.0.0
  - files_downloadlimit: 5.1.0
  - files_external: 1.25.1
  - files_pdfviewer: 6.0.0
  - files_reminders: 1.6.0
  - files_retention: 4.0.1
  - files_sharing: 1.25.2
  - files_trashbin: 1.23.0
  - files_versions: 1.26.0
  - firstrunwizard: 6.0.0
  - fulltextsearch_elasticsearch: 33.0.0
  - groupfolders: 21.0.8
  - logreader: 6.0.0
  - lookup_server_connector: 1.21.0
  - nextcloud_announcements: 5.0.0
  - notifications: 6.0.0
  - notify_push: 1.3.3
  - oauth2: 1.21.0
  - password_policy: 5.0.0
  - photos: 6.0.0
  - privacy: 5.0.0
  - profile: 1.2.0
  - provisioning_api: 1.23.0
  - recommendations: 6.0.0
  - related_resources: 4.0.0
  - serverinfo: 5.0.0
  - settings: 1.16.0
  - sharebymail: 1.23.0
  - support: 5.0.0
  - survey_client: 5.0.0
  - systemtags: 1.23.0
  - text: 7.0.1
  - theming: 2.8.0
  - theming_customcss: 1.20.0
  - twofactor_backupcodes: 1.22.0
  - twofactor_webauthn: 2.7.0
  - updatenotification: 1.23.0
  - user_status: 1.13.0
  - viewer: 6.0.0
  - weather_status: 1.13.0
  - webhook_listeners: 1.5.0
  - workflow_script: 4.0.0
  - workflowengine: 2.15.0
Disabled:
  - app_api: 33.0.0 (installed 33.0.0)
  - files_antivirus: 6.3.0 (installed 6.3.0)
  - onlyoffice: 10.1.0 (installed 10.1.0)
  - richdocuments: 10.2.0 (installed 10.2.0)
  - sendent: 4.2.8 (installed 4.2.8)
  - suspicious_login: 11.0.0
  - testing: 1.23.0
  - twofactor_nextcloud_notification: 7.0.0 (installed 7.0.0)
  - twofactor_totp: 15.0.0 (installed 15.0.0-dev.0)
  - user_ldap: 1.24.0 (installed 1.24.0)
  - user_saml: 8.1.2 (installed 8.1.2)

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

*Nextcloud 33.0.5.1
{"reqId":"ZTt5NV4Gka71tAGQBYNp","level":3,"time":"2026-06-19 16:03:26","remoteAddr":"xxx.xxx.xxx.xxx","user":"username","app":"webdav","method":"GET","url":"/remote.php/dav/files/username/A.pptx","scriptName":"/remote.php","message":"Bad Signature","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36","version":"33.0.5.1","exception":{"Exception":"OCP\\Encryption\\Exceptions\\GenericEncryptionException","Message":"Bad Signature","Code":0,"Trace":[{"file":"/var/www/html/nextcloud/apps/encryption/lib/Crypto/Crypt.php","line":433,"function":"checkSignature","class":"OCA\\Encryption\\Crypto\\Crypt","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/html/nextcloud/apps/encryption/lib/Crypto/Encryption.php","line":318,"function":"symmetricDecryptFileContent","class":"OCA\\Encryption\\Crypto\\Crypt","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/html/nextcloud/lib/private/Files/Stream/Encryption.php","line":461,"function":"decrypt","class":"OCA\\Encryption\\Crypto\\Encryption","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/html/nextcloud/lib/private/Files/Stream/Encryption.php","line":260,"function":"readCache","class":"OC\\Files\\Stream\\Encryption","type":"->"},{"function":"stream_read","class":"OC\\Files\\Stream\\Encryption","type":"->"},{"file":"/var/www/html/nextcloud/3rdparty/icewind/streams/src/Wrapper.php","line":54,"function":"fread"},{"file":"/var/www/html/nextcloud/3rdparty/icewind/streams/src/CallbackWrapper.php","line":94,"function":"stream_read","class":"Icewind\\Streams\\Wrapper","type":"->"},{"function":"stream_read","class":"Icewind\\Streams\\CallbackWrapper","type":"->"},{"file":"/var/www/html/nextcloud/3rdparty/sabre/http/lib/Sapi.php","line":108,"function":"stream_copy_to_stream"},{"file":"/var/www/html/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php","line":490,"function":"sendResponse","class":"Sabre\\HTTP\\Sapi","type":"::"},{"file":"/var/www/html/nextcloud/apps/dav/lib/Connector/Sabre/Server.php","line":212,"function":"invokeMethod","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/var/www/html/nextcloud/apps/dav/lib/Server.php","line":428,"function":"start","class":"OCA\\DAV\\Connector\\Sabre\\Server","type":"->"},{"file":"/var/www/html/nextcloud/apps/dav/appinfo/v2/remote.php","line":25,"function":"exec","class":"OCA\\DAV\\Server","type":"->"},{"file":"/var/www/html/nextcloud/remote.php","line":151,"args":["/var/www/html/nextcloud/apps/dav/appinfo/v2/remote.php"],"function":"require_once"}],"File":"/var/www/html/nextcloud/apps/encryption/lib/Crypto/Crypt.php","Line":457,"Hint":"\u4e0d\u6b63\u306a\u7f72\u540d","message":"Bad Signature","exception":"{\"class\":\"OCP\\Encryption\\Exceptions\\GenericEncryptionException\",\"message\":\"Bad Signature\",\"code\":0,\"file\":\"/var/www/html/nextcloud/apps/encryption/lib/Crypto/Crypt.php:457\",\"trace\":\"#0 /var/www/html/nextcloud/apps/encryption/lib/Crypto/Crypt.php(433): OCA\\Encryption\\Crypto\\Crypt->checkSignature()\\n#1 /var/www/html/nextcloud/apps/encryption/lib/Crypto/Encryption.php(318): OCA\\Encryption\\Crypto\\Crypt->symmetricDecryptFileContent()\\n#2 /var/www/html/nextcloud/lib/private/Files/Stream/Encryption.php(461): OCA\\Encryption\\Crypto\\Encryption->decrypt()\\n#3 /var/www/html/nextcloud/lib/private/Files/Stream/Encryption.php(260): OC\\Files\\Stream\\Encryption->readCache()\\n#4 [internal function]: OC\\Files\\Stream\\Encryption->stream_read()\\n#5 /var/www/html/nextcloud/3rdparty/icewind/streams/src/Wrapper.php(54): fread()\\n#6 /var/www/html/nextcloud/3rdparty/icewind/streams/src/CallbackWrapper.php(94): Icewind\\Streams\\Wrapper->stream_read()\\n#7 [internal function]: Icewind\\Streams\\CallbackWrapper->stream_read()\\n#8 /var/www/html/nextcloud/3rdparty/sabre/http/lib/Sapi.php(108): stream_copy_to_stream()\\n#9 /var/www/html/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php(490): Sabre\\HTTP\\Sapi::sendResponse()\\n#10 /var/www/html/nextcloud/apps/dav/lib/Connector/Sabre/Server.php(212): Sabre\\DAV\\Server->invokeMethod()\\n#11 /var/www/html/nextcloud/apps/dav/lib/Server.php(428): OCA\\DAV\\Connector\\Sabre\\Server->start()\\n#12 /var/www/html/nextcloud/apps/dav/appinfo/v2/remote.php(25): OCA\\DAV\\Server->exec()\\n#13 /var/www/html/nextcloud/remote.php(151): require_once('...')\\n#14 {main}\"}","CustomMessage":"Bad Signature"}}
{"reqId":"ZTt5NV4Gka71tAGQBYNp","level":3,"time":"2026-06-19 16:03:26","remoteAddr":"xxx.xxx.xxx.xxx","user":"username","app":"no app in context","method":"GET","url":"/remote.php/dav/files/username/A.pptx","scriptName":"/remote.php","message":"Uncaught exception","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36","version":"33.0.5.1","exception":{"Exception":"OCP\\Encryption\\Exceptions\\GenericEncryptionException","Message":"Bad Signature","Code":0,"Trace":[{"file":"/var/www/html/nextcloud/apps/encryption/lib/Crypto/Crypt.php","line":433,"function":"checkSignature","class":"OCA\\Encryption\\Crypto\\Crypt","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/html/nextcloud/apps/encryption/lib/Crypto/Encryption.php","line":318,"function":"symmetricDecryptFileContent","class":"OCA\\Encryption\\Crypto\\Crypt","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/html/nextcloud/lib/private/Files/Stream/Encryption.php","line":461,"function":"decrypt","class":"OCA\\Encryption\\Crypto\\Encryption","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/html/nextcloud/lib/private/Files/Stream/Encryption.php","line":260,"function":"readCache","class":"OC\\Files\\Stream\\Encryption","type":"->"},{"function":"stream_read","class":"OC\\Files\\Stream\\Encryption","type":"->"},{"file":"/var/www/html/nextcloud/3rdparty/icewind/streams/src/Wrapper.php","line":54,"function":"fread"},{"file":"/var/www/html/nextcloud/3rdparty/icewind/streams/src/CallbackWrapper.php","line":94,"function":"stream_read","class":"Icewind\\Streams\\Wrapper","type":"->"},{"function":"stream_read","class":"Icewind\\Streams\\CallbackWrapper","type":"->"},{"file":"/var/www/html/nextcloud/3rdparty/sabre/http/lib/Sapi.php","line":108,"function":"stream_copy_to_stream"},{"file":"/var/www/html/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php","line":490,"function":"sendResponse","class":"Sabre\\HTTP\\Sapi","type":"::"},{"file":"/var/www/html/nextcloud/apps/dav/lib/Connector/Sabre/Server.php","line":212,"function":"invokeMethod","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/var/www/html/nextcloud/apps/dav/lib/Server.php","line":428,"function":"start","class":"OCA\\DAV\\Connector\\Sabre\\Server","type":"->"},{"file":"/var/www/html/nextcloud/apps/dav/appinfo/v2/remote.php","line":25,"function":"exec","class":"OCA\\DAV\\Server","type":"->"},{"file":"/var/www/html/nextcloud/remote.php","line":151,"args":["/var/www/html/nextcloud/apps/dav/appinfo/v2/remote.php"],"function":"require_once"}],"File":"/var/www/html/nextcloud/apps/encryption/lib/Crypto/Crypt.php","Line":457,"Hint":"\u4e0d\u6b63\u306a\u7f72\u540d","message":"Uncaught exception","exception":"{\"class\":\"OCP\\Encryption\\Exceptions\\GenericEncryptionException\",\"message\":\"Bad Signature\",\"code\":0,\"file\":\"/var/www/html/nextcloud/apps/encryption/lib/Crypto/Crypt.php:457\",\"trace\":\"#0 /var/www/html/nextcloud/apps/encryption/lib/Crypto/Crypt.php(433): OCA\\Encryption\\Crypto\\Crypt->checkSignature()\\n#1 /var/www/html/nextcloud/apps/encryption/lib/Crypto/Encryption.php(318): OCA\\Encryption\\Crypto\\Crypt->symmetricDecryptFileContent()\\n#2 /var/www/html/nextcloud/lib/private/Files/Stream/Encryption.php(461): OCA\\Encryption\\Crypto\\Encryption->decrypt()\\n#3 /var/www/html/nextcloud/lib/private/Files/Stream/Encryption.php(260): OC\\Files\\Stream\\Encryption->readCache()\\n#4 [internal function]: OC\\Files\\Stream\\Encryption->stream_read()\\n#5 /var/www/html/nextcloud/3rdparty/icewind/streams/src/Wrapper.php(54): fread()\\n#6 /var/www/html/nextcloud/3rdparty/icewind/streams/src/CallbackWrapper.php(94): Icewind\\Streams\\Wrapper->stream_read()\\n#7 [internal function]: Icewind\\Streams\\CallbackWrapper->stream_read()\\n#8 /var/www/html/nextcloud/3rdparty/sabre/http/lib/Sapi.php(108): stream_copy_to_stream()\\n#9 /var/www/html/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php(490): Sabre\\HTTP\\Sapi::sendResponse()\\n#10 /var/www/html/nextcloud/apps/dav/lib/Connector/Sabre/Server.php(212): Sabre\\DAV\\Server->invokeMethod()\\n#11 /var/www/html/nextcloud/apps/dav/lib/Server.php(428): OCA\\DAV\\Connector\\Sabre\\Server->start()\\n#12 /var/www/html/nextcloud/apps/dav/appinfo/v2/remote.php(25): OCA\\DAV\\Server->exec()\\n#13 /var/www/html/nextcloud/remote.php(151): require_once('...')\\n#14 {main}\"}","CustomMessage":"Uncaught exception"}}

*Nextcloud 30.0.17.2
{"reqId":"IBpOAgWvMAG6GpjEqfeA","level":3,"time":"2026-06-19 15:39:32","remoteAddr":"xxx.xxx.xxx.xxx","user":"username","app":"webdav","method":"GET","url":"/remote.php/dav/files/username/A.pptx","message":"Bad Signature","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36","version":"30.0.17.2","exception":{"Exception":"OCP\\Encryption\\Exceptions\\GenericEncryptionException","Message":"Bad Signature","Code":0,"Trace":[{"file":"/var/www/html/nextcloud/apps/encryption/lib/Crypto/Crypt.php","line":434,"function":"checkSignature","class":"OCA\\Encryption\\Crypto\\Crypt","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/html/nextcloud/apps/encryption/lib/Crypto/Encryption.php","line":317,"function":"symmetricDecryptFileContent","class":"OCA\\Encryption\\Crypto\\Crypt","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/html/nextcloud/lib/private/Files/Stream/Encryption.php","line":493,"function":"decrypt","class":"OCA\\Encryption\\Crypto\\Encryption","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/html/nextcloud/lib/private/Files/Stream/Encryption.php","line":292,"function":"readCache","class":"OC\\Files\\Stream\\Encryption","type":"->"},{"function":"stream_read","class":"OC\\Files\\Stream\\Encryption","type":"->"},{"file":"/var/www/html/nextcloud/apps/files_external/3rdparty/icewind/streams/src/Wrapper.php","line":54,"function":"fread"},{"file":"/var/www/html/nextcloud/apps/files_external/3rdparty/icewind/streams/src/CallbackWrapper.php","line":94,"function":"stream_read","class":"Icewind\\Streams\\Wrapper","type":"->"},{"function":"stream_read","class":"Icewind\\Streams\\CallbackWrapper","type":"->"},{"file":"/var/www/html/nextcloud/3rdparty/sabre/http/lib/Sapi.php","line":110,"function":"stream_copy_to_stream"},{"file":"/var/www/html/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php","line":490,"function":"sendResponse","class":"Sabre\\HTTP\\Sapi","type":"::"},{"file":"/var/www/html/nextcloud/apps/dav/lib/Connector/Sabre/Server.php","line":49,"function":"invokeMethod","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/var/www/html/nextcloud/apps/dav/lib/Server.php","line":379,"function":"start","class":"OCA\\DAV\\Connector\\Sabre\\Server","type":"->"},{"file":"/var/www/html/nextcloud/apps/dav/appinfo/v2/remote.php","line":19,"function":"exec","class":"OCA\\DAV\\Server","type":"->"},{"file":"/var/www/html/nextcloud/remote.php","line":146,"args":["/var/www/html/nextcloud/apps/dav/appinfo/v2/remote.php"],"function":"require_once"}],"File":"/var/www/html/nextcloud/apps/encryption/lib/Crypto/Crypt.php","Line":458,"Hint":"\u4e0d\u6b63\u306a\u7f72\u540d","message":"Bad Signature","exception":{},"CustomMessage":"Bad Signature"}}

Additional info

No response

[MasamitsuEndo]

I monitored the results of the following SQL query while rolling back the file versions.

It appears that the version number for “encrypted” is gradually becoming corrupted.

SELECT fileid,path,encrypted FROM oc_filecache WHERE encrypted !=0 ORDER BY fileid;

Eventually, the encrypted version number for every file version becomes 1.

[provokateurin]

CC @come-nc

[joshtrichards]

Possibly related: #40029