[Bug]: Updater Backup removes base path from file path if it matches

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

On my server nextcloud is located in the path
/web/
The data-directory is located in /private/cloud_data
When creating a backup the updater removes the absolute base path from files. In some cases this leads to wrong target paths and thus the updater fails:

Exception
Message: Could not copy "/web/apps/files_pdfviewer/js/pdfjs/web/viewer.mjs.map" to "/private/cloud_data/updater-52658d475a10f/backups/nextcloud-32.0.6.1-1780920756//apps/files_pdfviewer/js/pdfjs"

this is because the updater explodes the path using the base path (in my case "/web/"). If this path occurs in the relative file path, the occurence and the part after it is removed from the used result ([1]):
$relativePath = explode($this->nextcloudDir, $absolutePath)[1];

Solution: use the $limit argument for explode, as we only need two parts:
$relativePath = explode($this->nextcloudDir, $absolutePath, 2)[1];

Steps to reproduce

1. install nextcloud in the path /web/ or any other path that occures in any of its file paths
2. open the updater and start the update
3. the updater will fail at step "backup"

Expected behavior

The updater creates the backup correctly and continues.

Nextcloud Server version

33

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.3

Web server

Apache (supported)

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

Updated from a MINOR version (ex. 32.0.1 to 32.0.2)

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{
    "system": {
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "version": "33.0.5.1",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbtableprefix": "nc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "loglevel": 3,
        "theme": "",
        "default_language": "de",
        "default_locale": "de_DE.utf-8",
        "maintenance": false,
        "forcessl": true,
        "trusted_domains": [
            "some.domain"
        ],
        "maintenance_window_start": 1,
        "mail_smtpmode": "smtp",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trashbin_retention_obligation": "auto",
        "overwrite.cli.url": "https:\/\/some.domain",
        "default_phone_region": "DE",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpauthtype": "LOGIN",
        "mail_sendmailmode": "pipe",
        "mysql.utf8mb4": true,
        "app_install_overwrite": [
            "calendar",
            "files_markdown"
        ],
        "updater.release.channel": "stable",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "465",
        "mail_smtpsecure": "ssl",
        "mail_smtpauth": true,
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "updater.secret": "***REMOVED SENSITIVE VALUE***"
    }
}

List of activated Apps

Enabled:
  - activity: 6.0.0
  - admin_audit: 1.23.0
  - app_api: 33.0.0
  - bookmarks: 16.1.4
  - calendar: 6.4.2
  - checksum: 2.1.2
  - circles: 33.0.0
  - cloud_federation_api: 1.17.0
  - comments: 1.23.0
  - contacts: 8.5.1
  - contactsinteraction: 1.14.1
  - dashboard: 7.13.0
  - dav: 1.36.0
  - federatedfilesharing: 1.23.0
  - federation: 1.23.0
  - files: 2.5.0
  - files_downloadlimit: 5.1.0
  - files_external: 1.25.1
  - files_markdown: 2.4.1
  - files_pdfviewer: 6.0.0
  - files_reminders: 1.6.0
  - files_sharing: 1.25.2
  - files_trashbin: 1.23.0
  - files_versions: 1.26.0
  - firstrunwizard: 6.0.0
  - impersonate: 4.0.0
  - logreader: 6.0.0
  - lookup_server_connector: 1.21.0
  - nextcloud_announcements: 5.0.0
  - notes: 6.0.0
  - notifications: 6.0.0
  - oauth2: 1.21.0
  - password_policy: 5.0.0
  - photos: 6.0.0
  - privacy: 5.0.0
  - profile: 1.2.0
  - provisioning_api: 1.23.0
  - recommendations: 6.0.0
  - related_resources: 4.0.0
  - serverinfo: 5.0.0
  - settings: 1.16.0
  - sharebymail: 1.23.0
  - support: 5.0.0
  - survey_client: 5.0.0
  - suspicious_login: 11.0.0
  - systemtags: 1.23.0
  - text: 7.0.1
  - theming: 2.8.0
  - twofactor_backupcodes: 1.22.0
  - twofactor_totp: 15.0.0
  - updatenotification: 1.23.0
  - user_status: 1.13.0
  - viewer: 6.0.0
  - weather_status: 1.13.0
  - webhook_listeners: 1.5.0
  - workflowengine: 2.15.0

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

2026-06-08T12:12:37+0000 hhvnxXpDkt [error] POST request failed with other exception
2026-06-08T12:12:37+0000 hhvnxXpDkt [error] Exception: Exception
Message: Could not copy "/web/apps/files_pdfviewer/js/pdfjs/web/viewer.mjs.map" to "/private/cloud_data/updater-52658d475a10f/backups/nextcloud-32.0.6.1-1780920756//apps/files_pdfviewer/js/pdfjs"
Code:0
Trace:
#0 /web/updater/index.php(1432): Updater->createBackup()
nextcloud/server#1 {main}
File:/web/updater/index.php
Line:489

Additional info

No response

Start in updater/index.php at the createBackup() path reported around line 489, and review how the relative path is derived from the absolute path. Reproduce an installation whose base path appears inside a file path, then verify that the backup completes and preserves the expected destination path; check the linked pull request before starting because work is already underway.