Summary: The pmproxy logger servlet (POST /logger/label) accepts a binary __pmLogLabel
PDU from any unauthenticated HTTP client and uses the hostname field to construct an
archive file path without sanitization. An attacker can supply hostname='../../../target/dir'
causing pmproxy to create files and directory trees at arbitrary paths accessible to the pcp
process user. The logger servlet is registered unconditionally in http.c:1326 - it is always
active regardless of pmproxy configuration.
Prerequisites: pmproxy reachable on TCP 44322. No authentication required. The logger
servlet has no authentication check.