CVE-2026-16531: Pcp: pcp: arbitrary file creation via path traversal in pmproxy logger servlet

Summary: The pmproxy logger servlet (POST /logger/label) accepts a binary pmLogLabel PDU from any unauthenticated HTTP client and uses the hostname field to construct an archive file path without sanitization. An attacker can supply hostname='../../../target/dir' causing pmproxy to create files and directory trees at arbitrary paths accessible to the pcp process user. The logger servlet is registered unconditionally in http.c:1326 - it is always active regardless of pmproxy configuration. Prerequisites: pmproxy reachable on TCP 44322. No authentication required. The logger servlet has no authentication check.

— Red Hat