Vulnerability Description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Software Version: 7.1.3
CVSS: 5.3
Severity: Medium
NVD: https://nvd.nist.gov/vuln/detail/cve-2026-16531
Credits: Francisco Alisson Bezerra, Lucas Gabriel Alves, Massimiliano Brolli
The pmproxy logger servlet (POST /logger/label) accepts a binary __pmLogLabel PDU from any unauthenticated HTTP client and uses the hostname field to construct an archive file path without sanitization. An attacker can supply hostname='../../../target/dir' causing pmproxy to create files and directory trees at arbitrary paths accessible to the pcp process user. The logger servlet is registered unconditionally in http.c:1326 - it is always active regardless of pmproxy configuration.
Prerequisites: pmproxy reachable on TCP 44322. No authentication required. The logger servlet has no authentication check.
Step-by-step Instructions and PoC
The pmproxy logger servlet accepts binary __pmLogLabel PDUs from any unauthenticated HTTP client via POST /logger/label. The hostname field in the decoded label is used directly to construct an archive directory path via pmsprintf(): "%s%c%s%c%s", base_dir, sep, hostname, sep, timebuf. The resulting path is passed to __pmMakePath(), which calls mkdir() for each path component individually. Because the kernel resolves '..' at each individual syscall, the directory traversal sequences in the hostname are resolved relative to the filesystem root rather than being blocked.
The logger servlet is registered unconditionally in http.c:1326 with no authentication check, making this endpoint always reachable on any pmproxy deployment regardless of configuration.
Affected Source Files and Lines
src/libpcp_web/src/loggroup.c:619-631: pmLogGroupLabel() - pmsprintf at lines 623-624 uses unsanitized hostname
Image 1 - pmLogGroupLabel() (loggroup.c:619). Highlighted lines 623-624: hostname field inserted into path without validation.
Affected Endpoints
URL (TCP 44322): POST /logger/label
The proof-of-concept (poc.py) builds a valid __pmLabel_v3 binary record embedding '../../../../tmp/pwned' as the hostname field and POSTs it to the unauthenticated /logger/label endpoint. Because pmproxy concatenates the hostname directly into the archive directory path without sanitization, the service creates .meta and .index files at the traversed location owned by the pcp user, outside the intended log directory.
Image 2 - Files in temp folder before the exploit execution.
Image 3 - Creation of a binary file with malicious PDU content.
Image 4 - Malicious file being sent to the vulnerable endpoint.
Image 5 - Folder created in temp folder after sending the malicious file.
Security Impact
An attacker can create files with PCP binary content and arbitrary directory trees in any path writable by the pcp process user.
Partial control of file content is possible via hostname, timezone, and zoneinfo fields.