CVE-2020-8290: Backblaze

High severity, CVSS 7.8. EPSS: 0.6% chance of exploitation in the next 30 days.

Backblaze for Windows and Backblaze for macOS before 7.0.0.439 suffer from improper privilege management in `bztransmit` helper due to lack of permission handling and validation before creation of client update directories allowing for local escalation of privilege via rogue client update binary.

Affected products

• Backblaze Backblaze: before 7.0.0.439 (fixed in 7.0.0.439)

Published 2020-12-27. Last modified 2026-06-17.