DLL sideloading via insecure install directory

Uncontrolled search path in Zabbix Agent for Windows before 6.0.48, 7.0.29, and 7.4.13 allows local users to execute code via a planted DLL. The Windows installer accepts a custom target path without checking that unprivileged users cannot modify it, so later DLL resolution can load attacker-supplied code from that writable directory. Exploitation requires local write access to the chosen installation path and a later program start; published records describe sideloading risk rather than a remote attack path.