This seems to a known an much discussed issue at ispConfig.
https://www.howtoforge.de/forum/threads/ispconfig-3-owncloud-5-0-nginx.6828/page-2#post-47077 (german)
This seems to do the trick for me though I have to idea if it breaks something else.
location ~ \.php$ {
##merge##
fastcgi_split_path_info ^(.+\.php)(/.*)$;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PATH_INFO $fastcgi_path_info;
fastcgi_param HTTPS on;
fastcgi_param modHeadersAvailable true; #Avoid sending the security headers twice
fastcgi_param front_controller_active true;
#fastcgi_pass php-handler;
#fastcgi_pass unix:/var/run/hhvm/hhvm.sock;
{FASTCGIPASS}
fastcgi_intercept_errors on;
fastcgi_request_buffering off;
}
location @php {
##delete##
}