[Bug]: Request for public.php returns 500

[gwire]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

I'm seeing failed requests for /public.php which are returning 500 instead of a 4xx status.

These requests are for public.php without any GET variables provided.

Steps to reproduce

1. run curl -I http://localhost/public.php or equivalent and check the status code.

Expected behavior

I would expect a 400 response where no arguments are provided, but a 404 may also be appropriate.

Nextcloud Server version

32

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.3

Web server

Nginx

Database engine version

None

Is this bug present after an update or on a fresh install?

None

Are you using the Nextcloud Server Encryption module?

None

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

List of activated Apps

Nextcloud Signing status

Nextcloud Logs

{"reqId":"Fvuf03hrGPu5KngRqVEE","level":3,"time":"2025-10-28T12:15:17+00:00","remoteAddr":"REDACTED","user":"--","app":"public","method":"GET","url":"/nextcloud/public.php","message":"Path not found","userAgent":"curl/8.7.1","version":"32.0.0.13","exception":{"Exception":"Exception","Message":"Path not found","Code":404,"Trace":[],"File":"/opt/nextcloud-32/public.php","Line":53,"message":"Path not found","exception":{},"CustomMessage":"Path not found"}}

Additional info

No response

[joshtrichards]

/public.php isn't really an endpoint per se.

The endpoint is always going to be something like /public.php/dav.

That said, we are setting code 500 so your experience matches current implementation:

server/public.php

Line 91 in b3abc41

} catch (Exception $ex) {

[provokateurin]

The question is rather where this invalid request is coming from. @gwire can you give any more details about that?

[gwire]

These requests GET /nextcloud/public.php/ HTTP/2.0 GET /nextcloud/public.php HTTP/2.0 are almost certainly coming from people running site vulnerability scanning tools without authorisation.

[provokateurin]

Okay, then I don't think there is any issue here. You could maybe deploy a software like fail2ban to stop those scanners.