Bug 2506037 (CVE-2026-16531)

Summary: CVE-2026-16531 PCP: PCP: Arbitrary file creation via path traversal in pmproxy logger servlet
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: kgaikwad, rhel-process-autobot, security-response-team, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and directory creation, potentially leading to a denial of service.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Deadline: 2026-07-30   

Description OSIDB Bzimport 2026-07-22 08:02:01 UTC 
Summary: The pmproxy logger servlet (POST /logger/label) accepts a binary __pmLogLabel
PDU from any unauthenticated HTTP client and uses the hostname field to construct an
archive file path without sanitization. An attacker can supply hostname='../../../target/dir'
causing pmproxy to create files and directory trees at arbitrary paths accessible to the pcp
process user. The logger servlet is registered unconditionally in http.c:1326 - it is always
active regardless of pmproxy configuration.
Prerequisites: pmproxy reachable on TCP 44322. No authentication required. The logger
servlet has no authentication check.