CVE-2026-30905

7.8 HIGH

External Control of File Name or Path in the Zoom Workplace VDI Plugin Windows Universal Installer before version 6.6.11 may allow an aut...

Published: 2026-05-13 · Last updated: 2026-06-03

Severity and scoring

CVSS: 7.8 HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-610, CWE-73

Affected products

Vendor	Product
zoom	workplace_virtual_desktop_infrastructure

Description

External Control of File Name or Path in the Zoom Workplace VDI Plugin Windows Universal Installer before version 6.6.11 may allow an authenticated user to conduct an escalation of privilege via local access.

Source: NVD

References

[NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-30905
[Vendor advisory]https://www.zoom.com/en/trust/security-bulletin/zsb-26007

Related CVEs

Same vendor

CVE-2026-30906 — Untrusted search path in the installer for Zoom Rooms for Windows before version 7.0.0 may allow an authenticated user to enable an escal... (7.8 HIGH)
CVE-2026-30904 — Protection Mechanism Failure in Zoom Workplace for iOS before version 7.0.0 may allow an authenticated user to conduct a disclosure of in... (1.8 LOW)

Same CWE

CVE-2026-45556 — Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers (9.9 CRITICAL)
CVE-2026-47643 — External control of file name or path in Azure Stack Edge allows an unauthorized attacker to execute code over a network (9.8 CRITICAL)
CVE-2025-12656 — The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary directory deletion due to ins... (3.8 LOW)
CVE-2026-46397 — HAX CMS helps manage microsite universe with PHP or NodeJs backends (6.5 MEDIUM)
CVE-2026-46399 — HAX CMS helps manage microsite universe with PHP or NodeJs backends