Path Traversal in PCP pmproxy Logger Servlet

Executive Summary

CVE-2026-16531 is a path traversal vulnerability in the PCP pmproxy logger servlet. An unauthenticated remote attacker can exploit it by sending a crafted hostname to create arbitrary files and directories on the system. This occurs because the pmproxy logger servlet does not properly sanitize the hostname field when constructing file paths.

Useful 0 Not Useful 0

Detection Guidance

Check if the pmproxy service is running on TCP port 44322. Use commands like 'ss -tulnp | grep 44322' or 'netstat -tulnp | grep 44322' to verify service exposure. Inspect logs for unusual file creation events in directories accessible to the pcp user.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to create files and directories anywhere the pcp process user has access. This could lead to denial of service by filling up disk space or overwriting critical files. Attackers might also place malicious files to escalate privileges or execute arbitrary code.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized file creation on systems handling sensitive data. Arbitrary file creation may lead to unauthorized access or modification of protected data, violating confidentiality and integrity requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately restrict access to TCP port 44322 using firewall rules. Disable or update the PCP pmproxy service to a patched version. Monitor for unauthorized file creation in system directories.

Useful 0 Not Useful 0