got a shell with CVE

sudo -l Matching Defaults entries for zabbix on unrested: env_reset, mail_badpass, secure_path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin, use_pty

User zabbix may run the following commands on unrested: (ALL : ALL) NOPASSWD: /usr/bin/nmap *

can run nmap

so nmap can run as root

script and interactive modes are disabled

—datadir option I was able to get a shell as root