{
  "threat_severity" : "Moderate",
  "public_date" : "2026-07-30T00:00:00Z",
  "bugzilla" : {
    "description" : "PCP: PCP: Arbitrary file creation via path traversal in pmproxy logger servlet",
    "id" : "2506037",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2506037"
  },
  "cvss3" : {
    "cvss3_base_score" : "5.3",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
    "status" : "draft"
  },
  "cwe" : "CWE-22",
  "details" : [ "An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and directory creation, potentially leading to a denial of service.", "An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and directory creation, potentially leading to a denial of service." ],
  "statement" : "Moderate: The pmproxy logger servlet in PCP is susceptible to a path traversal vulnerability, enabling an unauthenticated remote attacker to create arbitrary files and directories. This can lead to a denial of service or other impacts on systems where pmproxy is exposed on TCP port 44322, as the logger servlet is unconditionally active.",
  "acknowledgement" : "Red Hat would like to thank Francisco Alisson Bezerra (TIM Security Red Team Research, TIM S.p.A), Lucas Gabriel Alves (TIM Security Red Team Research, TIM S.p.A), and Massimiliano Brolli (TIM Security Red Team Research, TIM S.p.A) for reporting this issue.",
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Affected",
    "package_name" : "pcp",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Out of support scope",
    "package_name" : "pcp",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Out of support scope",
    "package_name" : "pcp",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Fix deferred",
    "package_name" : "pcp",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Fix deferred",
    "package_name" : "pcp",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Fix deferred",
    "package_name" : "rhcos",
    "cpe" : "cpe:/a:redhat:openshift:4"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-16531\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-16531" ],
  "name" : "CVE-2026-16531",
  "mitigation" : {
    "value" : "To mitigate this issue, restrict network access to TCP port 44322, which is used by the pmproxy service. This can be achieved by configuring a firewall to block incoming connections to this port. Alternatively, if the pmproxy service is not essential for your environment, it can be disabled.\nTo disable the pmproxy service:\nsudo systemctl stop pmproxy\nsudo systemctl disable pmproxy\nWarning: Disabling pmproxy may impact the functionality of Performance Co-Pilot components that rely on it for data collection and logging.",
    "lang" : "en:us"
  },
  "csaw" : false
}