Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-30T00:00:00 PCP: PCP: Arbitrary file creation via path traversal in pmproxy logger servlet 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CWE-22

An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and directory creation, potentially leading to a denial of service.

An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and directory creation, potentially leading to a denial of service.

Moderate: The pmproxy logger servlet in PCP is susceptible to a path traversal vulnerability, enabling an unauthenticated remote attacker to create arbitrary files and directories. This can lead to a denial of service or other impacts on systems where pmproxy is exposed on TCP port 44322, as the logger servlet is unconditionally active. Red Hat would like to thank Francisco Alisson Bezerra (TIM Security Red Team Research, TIM S.p.A), Lucas Gabriel Alves (TIM Security Red Team Research, TIM S.p.A), and Massimiliano Brolli (TIM Security Red Team Research, TIM S.p.A) for reporting this issue. To mitigate this issue, restrict network access to TCP port 44322, which is used by the pmproxy service. This can be achieved by configuring a firewall to block incoming connections to this port. Alternatively, if the pmproxy service is not essential for your environment, it can be disabled. To disable the pmproxy service: sudo systemctl stop pmproxy sudo systemctl disable pmproxy Warning: Disabling pmproxy may impact the functionality of Performance Co-Pilot components that rely on it for data collection and logging. Red Hat Enterprise Linux 10 Affected pcp Red Hat Enterprise Linux 6 Out of support scope pcp Red Hat Enterprise Linux 7 Out of support scope pcp Red Hat Enterprise Linux 8 Fix deferred pcp Red Hat Enterprise Linux 9 Fix deferred pcp Red Hat OpenShift Container Platform 4 Fix deferred rhcos https://www.cve.org/CVERecord?id=CVE-2026-16531 https://nvd.nist.gov/vuln/detail/CVE-2026-16531