CVE-2020-8289: Backblaze

High severity, CVSS 7.8. EPSS: 4.7% chance of exploitation in the next 30 days.

Backblaze for Windows before 7.0.1.433 and Backblaze for macOS before 7.0.1.434 suffer from improper certificate validation in `bztransmit` helper due to hardcoded whitelist of strings in URLs where validation is disabled leading to possible remote code execution via client update functionality.

Affected products

• Backblaze Backblaze: before 7.0.1.433 (fixed in 7.0.1.433); before 7.0.1.434 (fixed in 7.0.1.434)

Published 2020-12-27. Last modified 2026-06-17.