CVE-2020-8290

7.8 highEPSS 0.6%

Backblaze for Windows and Backblaze for macOS before 7.0.0.439 suffer from improper privilege management in `bztransmit` helper due to lack of permission handling and validation before creation of client update directories allowing for local escalation of privilege via rogue client update binary.

Severity

CVSS 3.1

7.8 high

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 48% of CVEs (scores of 2026-10-31)
CWE: CWE-269
Published: 2020-12-27
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

backblaze:backblaze

References

https://github.com/geffner/CVE-2020-8290/blob/master/README.md
https://hackerone.com/reports/818857
https://youtu.be/OpC6neWd2aM
https://github.com/geffner/CVE-2020-8290/blob/master/README.md
https://hackerone.com/reports/818857

Check your stack JSON