An installation path chosen for the Windows Zabbix Agent may be accepted without verifying that it has secure permissions. If the directory permits unprivileged users to modify its contents, an attacker can inject a malicious DLL that the agent will load during execution, exposing the system to potential code execution. The vulnerability stems from improper validation of user‑selected installation directories, which is a classic path manipulation weakness.

The affected product is Zabbix Zabbix. Any installation of the Zabbix Agent on a Windows system that allows a custom installation directory can be impacted. The CVE does not specify particular component versions, so all builds using the vulnerable installer are at risk until updated.

The CVSS score of 5.4 indicates moderate severity. An attacker would need to trick a privileged installer user into selecting or creating a malicious directory or would have to already have administrative rights to change permissions on an existing directory to exploit the weakness. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, implying that it is not currently known to be exploited in the wild. The most likely attack vector is via the installer routine on Windows, requiring the attacker to have some level of ability to influence the chosen path or its permissions.