Full title:

Public link share of a folder inside a Team folder (groupfolder) ignores read-only permission anonymous delete/rename/move/upload possible

Nextcloud groupfolders was updated last week - and now anybody can upload and delete files in any public link to a groupfolder you have shared!

Either revoke all your sharelinks, or apply the fixed lines yourself to the php files ...