Just as a remark, we run a bug bounty program at https://hackerone.com/nextcloud offering up to $5,000 for Remote Code Executions.

If someone here feels challenged: We look forward to your reports. :)