Every CVE Search/ Get API key

CVE-2026-16531

Pcp: pcp: arbitrary file creation via path traversal in pmproxy logger servlet

5.3 MediumFix available

An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and directory creation, potentially leading to a denial of service.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

0.51%Up 0.1 points since Jul 30, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.3

Pcp: pcp: arbitrary file creation via path traversal in pmproxy logger servlet

An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and directory creation, potentially leading to a denial of service.

Record
CVE-2026-16531
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-22
Updated
2026-11-05
EUVDEUVD-2026-50980 5.3

An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and directory creation, potentially leading to a denial of service.

Record
EUVD-2026-50980
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-05
GitHub AdvisoriesGHSA-2g52-w93h-w9v5 5.3

An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy...

An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and directory creation, potentially leading to a denial of service.

Record
GHSA-2g52-w93h-w9v5
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-22
Updated
2026-11-02
NVD 5.3

An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and directory creation, potentially leading to a denial of service.

Record
CVE-2026-16531
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-22
Updated
2026-11-05
OSVDEBIAN-CVE-2026-16531 5.3

An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and directory creation, potentially leading to a denial of service.

Record
DEBIAN-CVE-2026-16531
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-16531 5.3

An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and directory creation, potentially leading to a denial of service.

Record
UBUNTU-CVE-2026-16531
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
Show 10 moreShow less
OSVopenSUSE-SU-2026:11490-1 No score

libpcp-devel-6.3.8-3.1 on GA media

These are all security issues fixed in the libpcp-devel-6.3.8-3.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11490-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21636-1 No score

Security update for pcp

This update for pcp fixes the following issues:

  • CVE-2026-16524: command injection in linux_sockets PMDA via network.persocket.filter (bsc#1272922).
  • CVE-2026-16526: pmdaroot privilege escalation via FD_CLOEXEC fd inheritance and missing peer credentials (bsc#1272923).
  • CVE-2026-16527: missing authentication flags in pmproxy REST API (bsc#1272924).
  • CVE-2026-16529: integer overflow in __pmGetPDU leads to permanent DoS (bsc#1272925).
  • CVE-2026-16530: multiple OOB reads in libpcp record and PDU decoders (bsc#1272926).
  • CVE-2026-16531: path traversal via hostname in pmproxy logger servlet (bsc#1272927).
  • command injection in pmieconf write_pmiefile via $HOME and -f (bsc#1272928).
  • command injection in pmlogcp/pmlogmv do_link via unsanitised filenames (bsc#1272930).
Record
openSUSE-SU-2026:21636-1
Updated
2026-11-02
OSVSUSE-SU-2026:23064-1 No score

Security update for pcp

This update for pcp fixes the following issues:

  • CVE-2026-16524: command injection in linux_sockets PMDA via network.persocket.filter (bsc#1272922).
  • CVE-2026-16526: pmdaroot privilege escalation via FD_CLOEXEC fd inheritance and missing peer credentials (bsc#1272923).
  • CVE-2026-16527: missing authentication flags in pmproxy REST API (bsc#1272924).
  • CVE-2026-16529: integer overflow in __pmGetPDU leads to permanent DoS (bsc#1272925).
  • CVE-2026-16530: multiple OOB reads in libpcp record and PDU decoders (bsc#1272926).
  • CVE-2026-16531: path traversal via hostname in pmproxy logger servlet (bsc#1272927).
  • command injection in pmieconf write_pmiefile via $HOME and -f (bsc#1272928).
  • command injection in pmlogcp/pmlogmv do_link via unsanitised filenames (bsc#1272930).
Record
SUSE-SU-2026:23064-1
Updated
2026-11-02
OSVSUSE-SU-2026:23174-1 No score

Security update for pcp

This update for pcp fixes the following issues:

  • CVE-2026-16524: command injection in linux_sockets PMDA via network.persocket.filter (bsc#1272922).
  • CVE-2026-16526: pmdaroot privilege escalation via FD_CLOEXEC fd inheritance and missing peer credentials (bsc#1272923).
  • CVE-2026-16527: missing authentication flags in pmproxy REST API (bsc#1272924).
  • CVE-2026-16529: integer overflow in __pmGetPDU leads to permanent DoS (bsc#1272925).
  • CVE-2026-16530: multiple OOB reads in libpcp record and PDU decoders (bsc#1272926).
  • CVE-2026-16531: path traversal via hostname in pmproxy logger servlet (bsc#1272927).
  • command injection in pmieconf write_pmiefile via $HOME and -f (bsc#1272928).
  • command injection in pmlogcp/pmlogmv do_link via unsanitised filenames (bsc#1272930).
Record
SUSE-SU-2026:23174-1
Updated
2026-11-02
OSVSUSE-SU-2026:23277-1 No score

Security update for pcp

This update for pcp fixes the following issues:

  • CVE-2026-16524: command injection in linux_sockets PMDA via network.persocket.filter (bsc#1272922).
  • CVE-2026-16526: pmdaroot privilege escalation via FD_CLOEXEC fd inheritance and missing peer credentials (bsc#1272923).
  • CVE-2026-16527: missing authentication flags in pmproxy REST API (bsc#1272924).
  • CVE-2026-16529: integer overflow in __pmGetPDU leads to permanent DoS (bsc#1272925).
  • CVE-2026-16530: multiple OOB reads in libpcp record and PDU decoders (bsc#1272926).
  • CVE-2026-16531: path traversal via hostname in pmproxy logger servlet (bsc#1272927).
  • command injection in pmieconf write_pmiefile via $HOME and -f (bsc#1272928).
  • command injection in pmlogcp/pmlogmv do_link via unsanitised filenames (bsc#1272930).
Record
SUSE-SU-2026:23277-1
Updated
2026-11-02
OSVSUSE-SU-2026:23316-1 No score

Security update for pcp

This update for pcp fixes the following issues:

  • CVE-2026-16524: command injection in linux_sockets PMDA via network.persocket.filter (bsc#1272922).
  • CVE-2026-16526: pmdaroot privilege escalation via FD_CLOEXEC fd inheritance and missing peer credentials (bsc#1272923).
  • CVE-2026-16527: missing authentication flags in pmproxy REST API (bsc#1272924).
  • CVE-2026-16529: integer overflow in __pmGetPDU leads to permanent DoS (bsc#1272925).
  • CVE-2026-16530: multiple OOB reads in libpcp record and PDU decoders (bsc#1272926).
  • CVE-2026-16531: path traversal via hostname in pmproxy logger servlet (bsc#1272927).
  • command injection in pmieconf write_pmiefile via $HOME and -f (bsc#1272928).
  • command injection in pmlogcp/pmlogmv do_link via unsanitised filenames (bsc#1272930).
Record
SUSE-SU-2026:23316-1
Updated
2026-11-02
OSVSUSE-SU-2026:3505-1 No score

Security update for pcp

This update for pcp fixes the following issues:

  • CVE-2026-16524: command injection in linux_sockets PMDA via network.persocket.filter (bsc#1272922).
  • CVE-2026-16526: pmdaroot privilege escalation via FD_CLOEXEC fd inheritance and missing peer credentials (bsc#1272923).
  • CVE-2026-16527: missing authentication flags in pmproxy REST API (bsc#1272924).
  • CVE-2026-16529: integer overflow in __pmGetPDU leads to permanent DoS (bsc#1272925).
  • CVE-2026-16530: multiple OOB reads in libpcp record and PDU decoders (bsc#1272926).
  • CVE-2026-16531: path traversal via hostname in pmproxy logger servlet (bsc#1272927).
  • Command injection in pmieconf write_pmiefile via $HOME and -f (bsc#1272928).
  • Command injection in pmlogcp/pmlogmv do_link via unsanitised filenames (bsc#1272930).
Record
SUSE-SU-2026:3505-1
Updated
2026-11-02
OSVSUSE-SU-2026:3506-1 No score

Security update for pcp

This update for pcp fixes the following issues:

  • CVE-2026-16524: command injection in linux_sockets PMDA via network.persocket.filter (bsc#1272922).
  • CVE-2026-16526: pmdaroot privilege escalation via FD_CLOEXEC fd inheritance and missing peer credentials (bsc#1272923).
  • CVE-2026-16527: missing authentication flags in pmproxy REST API (bsc#1272924).
  • CVE-2026-16529: integer overflow in __pmGetPDU leads to permanent DoS (bsc#1272925).
  • CVE-2026-16530: multiple OOB reads in libpcp record and PDU decoders (bsc#1272926).
  • CVE-2026-16531: path traversal via hostname in pmproxy logger servlet (bsc#1272927).
  • command injection in pmieconf write_pmiefile via $HOME and -f (bsc#1272928).
  • command injection in pmlogcp/pmlogmv do_link via unsanitised filenames (bsc#1272930).
Record
SUSE-SU-2026:3506-1
Updated
2026-11-02
OSVSUSE-SU-2026:3507-1 No score

Security update for pcp

This update for pcp fixes the following issues:

  • CVE-2026-16524: command injection in linux_sockets PMDA via network.persocket.filter (bsc#1272922).
  • CVE-2026-16526: pmdaroot privilege escalation via FD_CLOEXEC fd inheritance and missing peer credentials (bsc#1272923).
  • CVE-2026-16527: missing authentication flags in pmproxy REST API (bsc#1272924).
  • CVE-2026-16529: integer overflow in __pmGetPDU leads to permanent DoS (bsc#1272925).
  • CVE-2026-16530: multiple OOB reads in libpcp record and PDU decoders (bsc#1272926).
  • CVE-2026-16531: path traversal via hostname in pmproxy logger servlet (bsc#1272927).
  • command injection in pmieconf write_pmiefile via $HOME and -f (bsc#1272928).
  • command injection in pmlogcp/pmlogmv do_link via unsanitised filenames (bsc#1272930).
Record
SUSE-SU-2026:3507-1
Updated
2026-11-02
OSVSUSE-SU-2026:3508-1 No score

Security update for pcp

This update for pcp fixes the following issues:

  • CVE-2026-16524: command injection in linux_sockets PMDA via network.persocket.filter (bsc#1272922).
  • CVE-2026-16526: pmdaroot privilege escalation via FD_CLOEXEC fd inheritance and missing peer credentials (bsc#1272923).
  • CVE-2026-16527: missing authentication flags in pmproxy REST API (bsc#1272924).
  • CVE-2026-16529: integer overflow in __pmGetPDU leads to permanent DoS (bsc#1272925).
  • CVE-2026-16530: multiple OOB reads in libpcp record and PDU decoders (bsc#1272926).
  • CVE-2026-16531: path traversal via hostname in pmproxy logger servlet (bsc#1272927).
  • command injection in pmieconf write_pmiefile via $HOME and -f (bsc#1272928).
  • command injection in pmlogcp/pmlogmv do_link via unsanitised filenames (bsc#1272930).
Record
SUSE-SU-2026:3508-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
pcp
Debian:12
 All versions, plus listed versions
6.0.3-1.16.0.5-16.1.0-16.1.1-16.2.0-1
Show 27 moreShow less
6.2.0-1.16.2.0-1.1~exp16.2.1-16.2.2-16.3.0-16.3.1-16.3.3-16.3.4-16.3.5-16.3.6-16.3.7-16.3.8-17.0.0-17.0.1-17.0.2-17.0.3-17.0.4-17.0.5-17.1.0-17.1.1-17.1.2-17.1.3-27.1.4-17.1.5-17.2.0-17.2.1-27.2.2-1
 None known
pcp
Debian:13
 All versions, plus listed versions
6.3.8-17.0.0-17.0.1-17.0.2-17.0.3-1
Show 11 moreShow less
7.0.4-17.0.5-17.1.0-17.1.1-17.1.2-17.1.3-27.1.4-17.1.5-17.2.0-17.2.1-27.2.2-1
 None known
pcp
Debian:14
 before 7.2.0-1, plus listed versions
6.3.8-17.0.0-17.0.1-17.0.2-17.0.3-1
Show 8 moreShow less
7.0.4-17.0.5-17.1.0-17.1.1-17.1.2-17.1.3-27.1.4-17.1.5-1
7.2.0-1
pcp
SUSE:Linux Micro 6.0
From an advisory covering 6 CVEs
 before 6.2.0-2.1
6.2.0-2.1
pcp
SUSE:Linux Micro 6.1
From an advisory covering 6 CVEs
 before 6.2.0-slfo.1.1_6.1
6.2.0-slfo.1.1_6.1
pcp
SUSE:Linux Micro 6.2
From an advisory covering 6 CVEs
 before 6.2.0-160000.4.1
6.2.0-160000.4.1
pcp
SUSE:Linux Enterprise Server 16.0
From an advisory covering 6 CVEs
 before 6.2.0-160000.4.1
6.2.0-160000.4.1
pcp
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 6 CVEs
 before 6.2.0-160000.4.1
6.2.0-160000.4.1
pcp
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 6 CVEs
 before 6.2.0-150500.8.9.1
6.2.0-150500.8.9.1
pcp
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 6 CVEs
 before 6.2.0-150500.8.9.1
6.2.0-150500.8.9.1
Show 20 moreShow less
Affected packages
PackageAffectedFixed
pcp
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 6 CVEs
 before 6.2.0-150500.8.9.1
6.2.0-150500.8.9.1
pcp
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 6 CVEs
 before 6.2.0-150500.8.9.1
6.2.0-150500.8.9.1
pcp
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 6 CVEs
 before 6.2.0-150400.5.15.1
6.2.0-150400.5.15.1
pcp
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 6 CVEs
 before 6.2.0-150400.5.15.1
6.2.0-150400.5.15.1
pcp
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 6 CVEs
 before 6.2.0-150400.5.15.1
6.2.0-150400.5.15.1
pcp
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 6 CVEs
 before 6.2.0-150400.5.15.1
6.2.0-150400.5.15.1
pcp
SUSE:Linux Enterprise Module for Development Tools 15 SP7
From an advisory covering 6 CVEs
 before 6.2.0-150600.3.12.1
6.2.0-150600.3.12.1
pcp
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 6 CVEs
 before 6.2.0-150600.3.12.1
6.2.0-150600.3.12.1
pcp
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 6 CVEs
 before 6.2.0-150600.3.12.1
6.2.0-150600.3.12.1
pcp
SUSE:Linux Enterprise Server 12 SP5-LTSS
From an advisory covering 6 CVEs
 before 6.2.0-6.32.1
6.2.0-6.32.1
pcp
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 6 CVEs
 before 6.2.0-6.32.1
6.2.0-6.32.1
pcp
Ubuntu:16.04:LTS
 All versions, plus listed versions
3.10.63.10.83.10.8build1
 None known
pcp
Ubuntu:18.04:LTS
 All versions, plus listed versions
3.12.13.12.2-14.0.0-14.0.1-1
 None known
pcp
Ubuntu:20.04:LTS
 All versions, plus listed versions
4.3.4-1build14.3.4-1build25.0.0-15.0.1-15.0.2-1.15.0.2-1.1build15.0.3-1
 None known
pcp
Ubuntu:22.04:LTS
 All versions, plus listed versions
5.3.2-15.3.4-15.3.5-15.3.5-1build15.3.6-1build1
 None known
pcp
Ubuntu:24.04:LTS
 All versions, plus listed versions
6.0.5-16.1.0-16.1.1-16.1.1-1build26.2.0-16.2.0-1.1build36.2.0-1.1build4
 None known
pcp
Ubuntu:26.10
 All versions, plus listed versions
7.1.1-17.1.3-27.1.4-17.1.5-17.2.0-17.2.1-27.2.1-2build1
 None known
pcp
Ubuntu:26.04:LTS
 All versions, plus listed versions
6.3.8-17.0.2-17.1.0-17.1.1-1
 None known
pcp
openSUSE:Tumbleweed
From an advisory covering 6 CVEs
 before 6.3.8-3.1
6.3.8-3.1
pcp
openSUSE:Leap 16.0
From an advisory covering 6 CVEs
 before 6.2.0-160000.4.1
6.2.0-160000.4.1

History

History
RecordedChangedSources
affectedNVD
productsCVE List
factsEUVD
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-16531 is a medium vulnerability (CVSS 5.3) in Red Hat Enterprise Linux 10, published July 30, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.51%, the 43rd percentile. Fixed in pcp 7.2.0-1.

References

Show 23 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open