Information disclosure via unchecked sensitive upload paths

Information disclosure in Nextcloud Android Client before 3.16.1 allows attackers to read private data through a malicious sharing app. The upload-from-share flow accepted paths inside the app's private storage, allowing a chosen recipient app to obtain shared-preference files. Exploitation requires a malicious app on the same device and a victim who initiates sharing and selects that app; exposed data includes push tokens and the account name.