Arbitrary file write via unprotected intent path traversal

Path traversal in Nextcloud Talk Android before 17.0.0 allows local users to write files outside the app's cache via a crafted intent. An unprotected intent handler passes an attacker-controlled content URI to FileUtil cache-copy logic, which derives a destination without first confining its canonical path to the cache directory. Exploitation requires a malicious third-party Android app and user interaction; the resulting write escapes the intended cache boundary.