[Bug]: Forms: `"CustomMessage":"The filename fallback must only contain ASCII characters."}` error

⚠️ This issue respects the following points: ⚠️

• This is not a troubleshooting question, general support matter, or webserver/proxy problem, but likely a bug (if unsure, ask the Community Help Forum).
• This issue is not already reported on Github OR solved at the Community Help Forum (I've searched!).
• I'm using a maintained major version of Nextcloud Server and tested against the latest patch level. (Supported major versions and current patch levels).
• I agree to follow Nextcloud's Code of Conduct.
• I've tried my best to provide clear reproduction steps that someone unfamiliar with this bug could use to reproduce it.

Bug description

During the export to spreadsheet of a form, NC returns an error (not clearly reported to the final user) and the file in not created.

Looking at the logging section I can find several records reporting some information about that error. One of them reports "CustomMessage":"The filename fallback must only contain ASCII characters."}. I looked at the database and the problem was a \n inside the form title.

Steps to reproduce

1. Open Forms section.
2. Create a new form.
3. Paste a title that contains a carriage return.
4. Go to Responses.
5. slick ··· save file or select Create spreadsheet.

Expected behavior

A POSIX character cleaning system for the field title should prevent this occurrence.

Nextcloud Server version

33

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.3

Web server

Apache (supported)

Database engine version

PostgreSQL

Is this bug present after an update or on a fresh install?

No response

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{
    "system": {
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "cloud.vatlib.it",
            "oods.vatlib.it"
        ],
        "enable_previews": true,
        "enabledPreviewProviders": [
            "OC\\Preview\\PNG",
            "OC\\Preview\\JPEG",
            "OC\\Preview\\GIF",
            "OC\\Preview\\HEIC",
            "OC\\Preview\\BMP",
            "OC\\Preview\\XBitmap",
            "OC\\Preview\\MP3",
            "OC\\Preview\\TXT",
            "OC\\Preview\\MarkDown",
            "OC\\Preview\\TIFF"
        ],
        "default_phone_region": "VA",
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "version": "33.0.8.2",
        "overwrite.cli.url": "https:\/\/cloud.vatlib.it\/nextcloud",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "log_type": "file",
        "logfile": "\/var\/log\/nextcloud\/nextcloud.log",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "maintenance": false,
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpmode": "smtp",
        "mail_sendmailmode": "smtp",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "587",
        "loglevel": 3,
        "mail_smtpauth": 1,
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "theme": "",
        "app_install_overwrite": [
            "bookmarks_fulltextsearch",
            "files_fulltextsearch",
            "files_zip",
            "files_mindmap"
        ],
        "trashbin_retention_obligation": "240, 240"
    }
}

List of activated Apps

Enabled:
  - activity: 6.0.0
  - admin_audit: 1.23.0
  - app_api: 33.0.0
  - audioplayer: 3.9.0
  - bruteforcesettings: 6.0.0
  - calendar: 6.5.4
  - circles: 33.0.0
  - cloud_federation_api: 1.17.0
  - comments: 1.23.0
  - contacts: 8.9.0
  - contactsinteraction: 1.14.1
  - dashboard: 7.13.0
  - dav: 1.36.1
  - drawio: 4.3.8
  - event_update_notification: 2.10.0
  - federatedfilesharing: 1.23.0
  - federation: 1.23.0
  - files: 2.5.0
  - files_automatedtagging: 4.0.0
  - files_downloadlimit: 5.1.0
  - files_fulltextsearch: 33.0.0
  - files_mindmap: 0.1.1
  - files_pdfviewer: 6.0.0
  - files_reminders: 1.6.0
  - files_retention: 4.0.1
  - files_sharing: 1.25.2
  - files_trashbin: 1.23.0
  - files_versions: 1.26.0
  - files_zip: 3.0.1
  - firstrunwizard: 6.0.0
  - forms: 5.4.0
  - fulltextsearch: 33.0.0
  - fulltextsearch_elasticsearch: 33.0.0
  - gpoddersync: 3.17.0
  - impersonate: 4.0.0
  - logreader: 6.0.0
  - lookup_server_connector: 1.21.0
  - nextcloud_announcements: 5.0.0
  - notes: 6.1.0
  - notifications: 6.0.0
  - notify_push: 1.4.1
  - oauth2: 1.21.0
  - onlyoffice: 10.1.2
  - password_policy: 5.0.0
  - photos: 6.0.0
  - polls: 9.2.1
  - privacy: 5.0.0
  - profile: 1.2.0
  - provisioning_api: 1.23.0
  - recommendations: 6.0.0
  - related_resources: 4.0.0
  - serverinfo: 5.0.0
  - settings: 1.16.0
  - sharebymail: 1.23.0
  - spreed: 23.0.11
  - support: 5.0.0
  - survey_client: 5.0.0
  - suspicious_login: 11.0.0
  - systemtags: 1.23.0
  - tasks: 0.18.1
  - text: 7.0.1
  - theming: 2.8.0
  - twofactor_backupcodes: 1.22.0
  - twofactor_nextcloud_notification: 7.0.0
  - twofactor_totp: 15.0.0
  - updatenotification: 1.23.0
  - user_ldap: 1.24.0
  - user_status: 1.13.0
  - viewer: 6.0.0
  - weather_status: 1.13.0
  - webhook_listeners: 1.5.0
  - workflowengine: 2.15.0
Disabled:
  - apporder: 0.15.0 (installed 0.15.0)
  - assistant: 3.5.0 (installed 2.9.0)
  - attendance: 1.51.2 (installed 1.51.2)
  - bookmarks_fulltextsearch: 1.2.0 (installed 1.2.0)
  - encryption: 2.21.0
  - extract: 1.3.6 (installed 1.3.6)
  - files_downloadactivity: 1.18.1 (installed 1.18.1)
  - files_external: 1.25.1
  - files_photospheres: 1.33.1 (installed 1.33.1)
  - files_rightclick: 0.15.1 (installed 1.3.0)
  - files_scripts: 5.0.1 (installed 5.0.1)
  - signlive: 0.9.9 (installed 0.9.9)
  - twofactor_email: 3.4.2 (installed 3.4.2)

Nextcloud Signing status

Technical information
=====================
The following list covers which files have failed the integrity check. Please read
the previous linked documentation to learn more about the errors and how to fix
them.

Results
=======
- core
	- INVALID_HASH
		- core/js/mimetypelist.js

Raw output
==========
Array
(
    [core] => Array
        (
            [INVALID_HASH] => Array
                (
                    [core/js/mimetypelist.js] => Array
                        (
                            [expected] => cb945c6402e12d9e7d42d0359acf95a6e9a9b0c1f3bd8528f598a7fb1694e5ae34c80cf44ef6c8901eac1bfdd152de3315fc7eac007efee0f33f09ed3e518b6a
                            [current] => 6b290ba45e633706e1fe761ca21422053c113f17b2bb35f2351f2cf1c3b893aa543af6c594077ca213c755cfa0d002e22109bb1797bbadd8fb410ca839143e0e
                        )

                )

        )

)

Nextcloud Logs

{"reqId":"9YGxvogXIiSviNc014hE","level":3,"time":"2026-09-18T07:16:21+00:00","remoteAddr":"X.X.X.X","user":"f4d3775e-ecfd-1035-8310-7d20fe53af5f","app":"no app in context","method":"GET","url":"/ocs/v2.php/apps/forms/api/v3/forms/28/submissions?requesttoken=WZpJAk7v5jBfYHyeHuquO03bNiqeTX56UmOzrUFnDZI%3D%3AH9B8VSm%2BqXcxUk6xLJzPczWdQx3PBj0iIzHbmBchTtU%3D&fileFormat=csv","scriptName":"/ocs/v2.php","message":"The filename fallback must only contain ASCII characters.","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:155.0) Gecko/20100101 Firefox/155.0","version":"33.0.8.2","exception":{"Exception":"InvalidArgumentException","Message":"The filename fallback must only contain ASCII characters.","Code":0,"Trace":[{"file":"/var/www/nextcloud/lib/public/AppFramework/Http/DownloadResponse.php","line":36,"function":"makeDisposition","class":"Symfony\\Component\\HttpFoundation\\HeaderUtils","type":"::"},{"file":"/var/www/nextcloud/lib/public/AppFramework/Http/DataDownloadResponse.php","line":38,"function":"__construct","class":"OCP\\AppFramework\\Http\\DownloadResponse","type":"->"},{"file":"/var/www/nextcloud/apps/forms/lib/Controller/ApiController.php","line":1247,"function":"__construct","class":"OCP\\AppFramework\\Http\\DataDownloadResponse","type":"->"},{"file":"/var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php","line":205,"function":"getSubmissions","class":"OCA\\Forms\\Controller\\ApiController","type":"->"},{"file":"/var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php","line":118,"function":"executeController","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->"},{"file":"/var/www/nextcloud/lib/private/AppFramework/App.php","line":153,"function":"dispatch","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->"},{"file":"/var/www/nextcloud/lib/private/Route/Router.php","line":321,"function":"main","class":"OC\\AppFramework\\App","type":"::"},{"file":"/var/www/nextcloud/ocs/v1.php","line":61,"function":"match","class":"OC\\Route\\Router","type":"->"},{"file":"/var/www/nextcloud/ocs/v2.php","line":8,"args":["/var/www/nextcloud/ocs/v1.php"],"function":"require_once"}],"File":"/var/www/nextcloud/3rdparty/symfony/http-foundation/HeaderUtils.php","Line":177,"message":"The filename fallback must only contain ASCII characters.","exception":"{\"class\":\"InvalidArgumentException\",\"message\":\"The filename fallback must only contain ASCII characters.\",\"code\":0,\"file\":\"/var/www/nextcloud/3rdparty/symfony/http-foundation/HeaderUtils.php:177\",\"trace\":\"#0 /var/www/nextcloud/lib/public/AppFramework/Http/DownloadResponse.php(36): Symfony\\Component\\HttpFoundation\\HeaderUtils::makeDisposition()\\n#1 /var/www/nextcloud/lib/public/AppFramework/Http/DataDownloadResponse.php(38): OCP\\AppFramework\\Http\\DownloadResponse->__construct()\\n#2 /var/www/nextcloud/apps/forms/lib/Controller/ApiController.php(1247): OCP\\AppFramework\\Http\\DataDownloadResponse->__construct()\\n#3 /var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php(205): OCA\\Forms\\Controller\\ApiController->getSubmissions()\\n#4 /var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php(118): OC\\AppFramework\\Http\\Dispatcher->executeController()\\n#5 /var/www/nextcloud/lib/private/AppFramework/App.php(153): OC\\AppFramework\\Http\\Dispatcher->dispatch()\\n#6 /var/www/nextcloud/lib/private/Route/Router.php(321): OC\\AppFramework\\App::main()\\n#7 /var/www/nextcloud/ocs/v1.php(61): OC\\Route\\Router->match()\\n#8 /var/www/nextcloud/ocs/v2.php(8): require_once('...')\\n#9 {main}\"}","CustomMessage":"The filename fallback must only contain ASCII characters."},"id":"6aaceebb64ebf"}

Additional info

No response

Start at apps/forms/lib/Controller/ApiController.php around line 1247, where the submissions export creates the download response, and trace the filename passed into DataDownloadResponse. Reproduce the export with a form title containing a carriage return, then verify that CSV or spreadsheet creation succeeds and the resulting filename meets the required character constraints.