Content spoofing due to the improper behavior of the 403 page

How it was found

Content spoofing, also referred to as content injection or virtual defacement, is an attack targeting a user made possible by an injection vulnerability in a web application.

PoC: https://usercontent.apps.nextcloud.com/.htaccess***********this%20page%20has%20moved%20to%20http://evil.com%20***************

thanks.