CVE-2026-30903

Executive Summary

CVE-2026-30903 is a critical vulnerability in the Mail feature of Zoom Workplace for Windows, allowing an unauthenticated attacker to perform an escalation of privilege via network access. The flaw stems from improper external control of file names or paths (CWE-73), enabling an attacker to manipulate file operations within the mail component to gain elevated privileges. With a CVSS score of 9.6, this vulnerability poses a severe risk to confidentiality, integrity, and availability. Zoom has released a patch in version 6.6.0, and immediate upgrade is recommended.

CVSS Breakdown & Threat Level

• CVSS Score: 9.6 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)
• EPSS Score: 0.0% (Low exploitation probability currently)

Deep Dive & Mechanics

The vulnerability resides in the Mail feature of Zoom Workplace for Windows. The application fails to properly sanitize user-supplied input when constructing file paths for email attachments or related operations. An unauthenticated attacker can send a specially crafted network request to the Zoom Mail service, causing it to write or read files outside the intended directory. This can lead to arbitrary file write, overwriting critical system files, or reading sensitive data, ultimately resulting in privilege escalation to SYSTEM or Administrator level.

The attack does not require authentication or user interaction, making it highly dangerous for enterprise environments where Zoom Workplace is deployed. The flaw is classified under CWE-73 (External Control of File Name or Path), which is a classic path traversal vulnerability.

Vulnerable vs. Patched Code

Vulnerable Code (Zoom Workplace < 6.6.0):

// Pseudocode for vulnerable mail attachment handling
void ProcessMailAttachment(const std::string& userInputPath) {
    std::string fullPath = "C:\\Zoom\\Mail\\Attachments\\" + userInputPath;
    // No validation of userInputPath for directory traversal
    WriteFile(fullPath, data);
}

Patched Code (Zoom Workplace >= 6.6.0):

// Pseudocode for patched mail attachment handling
void ProcessMailAttachment(const std::string& userInputPath) {
    std::string sanitizedPath = SanitizePath(userInputPath);
    if (sanitizedPath.empty() || sanitizedPath.find("..") != std::string::npos) {
        return; // Reject malicious input
    }
    std::string fullPath = "C:\\Zoom\\Mail\\Attachments\\" + sanitizedPath;
    WriteFile(fullPath, data);
}

The patch introduces input validation to reject path traversal sequences (e.g., ..) and ensures only safe file names are used.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running Zoom Workplace for Windows < 6.6.0
• Network access to the Zoom Mail service (typically on port 443 or a custom port)

Exploitation Steps:

1. Identify the Zoom Mail service endpoint (e.g., https://target:port/mail/attachment).
2. Craft a POST request with a malicious file path parameter:

   POST /mail/attachment HTTP/1.1
   Host: target:port
   Content-Type: application/x-www-form-urlencoded
   
   filePath=..\..\Windows\System32\evil.dll&data=...
   

3. The server writes the attacker-controlled data to C:\Windows\System32\evil.dll.
4. Trigger execution of the DLL (e.g., via scheduled task or service restart) to gain SYSTEM privileges.

Note: No public exploit code is available; this is a conceptual demonstration.

Blue Team

Detection:

• Monitor for unusual file writes to system directories (e.g., C:\Windows\System32) from the Zoom process.
• Look for HTTP requests to the Zoom Mail service containing path traversal patterns (..\ or ../).
• Enable logging on Zoom Workplace and review mail attachment operations.

Hunting:

• Search for file creation events with paths containing .. sequences.
• Correlate network connections to Zoom Mail service with subsequent privilege escalation alerts.

Indicators of Compromise (IOCs)

• File Paths: C:\Windows\System32\*.dll written by Zoom.exe
• Network Patterns: HTTP POST requests to /mail/attachment with filePath parameter containing ..
• Registry Keys: Unauthorized modifications to HKLM\SYSTEM\CurrentControlSet\Services for persistence
• Process Anomalies: Zoom.exe spawning cmd.exe or powershell.exe

Detection Engineering

YARA Rule

rule CVE_2026_30903_Zoom_Mail_PathTraversal {
    meta:
        description = "Detects path traversal attempts in Zoom Mail requests"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2026-30903"
    strings:
        $path_traversal = /\.\.\\|\.\.\//
        $mail_endpoint = "/mail/attachment"
    condition:
        $mail_endpoint and $path_traversal
}

Sigma Rule

title: Zoom Mail Path Traversal Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests to Zoom Mail service with path traversal patterns
author: Valters IT
logsource:
    category: webserver
    product: zoom
detection:
    selection:
        cs-uri-query|contains: "/mail/attachment"
        cs-uri-query|contains: ".."
    condition: selection
falsepositives:
    - Legitimate use of double dots in file names (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-30903 Zoom Mail Path Traversal"; flow:to_server; content:"/mail/attachment"; http_uri; content:".."; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Patch: Upgrade Zoom Workplace for Windows to version 6.6.0 or later.
2. Network Segmentation: Restrict network access to Zoom Mail service to trusted hosts only.
3. Input Validation: Implement strict input validation for all file path parameters.
4. Monitoring: Deploy the provided detection rules to identify exploitation attempts.
5. Least Privilege: Run Zoom Workplace with minimal necessary privileges.

Report generated by Valters IT DevSecOps & CTI Division