ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Vendor

Backblaze

5 mentions in 7 days · 5 in 30 days · 5 total · first seen · last

Search everything

Timeline

ZDI-26-624: Backblaze Personal Computer Backup bzbackup Link Following Denial-of-Service Vulnerability

ZDI disclosed CVE-2026-19820, a CVSS 6.1 local link-following denial-of-service flaw in the bzbackup component of Backblaze Personal Computer Backup.

The Zero Day Initiative published advisory ZDI-26-624 for a denial-of-service vulnerability in Backblaze Personal Computer Backup's bzbackup component. A local attacker must first gain the ability to run low-privileged code on the target system to trigger the link-following flaw. ZDI rated the issue CVSS 6.1 and assigned CVE-2026-19820.

ZDI Published Advisories · 6d agoAdvisory 5 sourcesCVE-2026-19820

ZDI-26-625: Backblaze Personal Computer Backup bzserv Link Following Denial-of-Service Vulnerability

ZDI disclosed CVE-2026-19820, a CVSS 6.1 local link-following denial-of-service flaw in the bzserv component of Backblaze Personal Computer Backup.

The Zero Day Initiative published advisory ZDI-26-625 for a denial-of-service vulnerability in Backblaze Personal Computer Backup's bzserv component. A local attacker must already be able to execute low-privileged code on the system to trigger the flaw, which involves link following. ZDI assigned a CVSS score of 6.1 and the CVE identifier CVE-2026-19820.

ZDI Published Advisories · 6d agoAdvisory 5 sourcesCVE-2026-19820

ZDI-26-627: Backblaze Personal Computer Backup bztransmit Link Following Denial-of-Service Vulnerability

ZDI published ZDI-26-627 for a local denial-of-service flaw (CVE-2026-19820, CVSS 6.1) in Backblaze Personal Computer Backup's bztransmit component.

The Zero Day Initiative published advisory ZDI-26-627 describing a link-following denial-of-service vulnerability in the bztransmit component of Backblaze Personal Computer Backup. Local attackers must first execute low-privileged code on the target system to trigger the condition. The issue carries a CVSS score of 6.1 and is tracked as CVE-2026-19820.

ZDI Published Advisories · 6d agoVulnerability 5 sourcesCVE-2026-19820

ZDI-26-628: Backblaze Personal Computer Backup bzreports Link Following Denial-of-Service Vulnerability

ZDI disclosed CVE-2026-19820, a CVSS 6.1 local link-following denial-of-service flaw in the bzreports component of Backblaze Personal Computer Backup.

The Zero Day Initiative published advisory ZDI-26-628 for a denial-of-service vulnerability in Backblaze Personal Computer Backup's bzreports component. A local attacker must first obtain the ability to execute low-privileged code on the system to exploit the link-following flaw. ZDI rated the issue CVSS 6.1 and assigned CVE-2026-19820.

ZDI Published Advisories · 6d agoAdvisory 5 sourcesCVE-2026-19820

ZDI-26-626: Backblaze Personal Computer Backup bzfilelist Link Following Denial-of-Service Vulnerability

ZDI published ZDI-26-626 for a local denial-of-service flaw (CVE-2026-19820, CVSS 6.1) in Backblaze Personal Computer Backup's bzfilelist component.

The Zero Day Initiative published advisory ZDI-26-626 describing a link-following denial-of-service vulnerability in the bzfilelist component of Backblaze Personal Computer Backup. Local attackers must first execute low-privileged code on the target system to trigger the condition. The issue carries a CVSS score of 6.1 and is tracked as CVE-2026-19820.

ZDI Published Advisories · 6d agoVulnerability 5 sourcesCVE-2026-19820

Related CVEs

  • CVE-2026-198207.8<1%
    Unbootable-System Denial of Service via Link Following in Backblaze Windows Backup Client
    CVE-2026-19820 is a link-following flaw (CWE-59) in the Backblaze Personal Computer Backup client for Windows, whose backup components (bzserv, bztransmit, bzfilelist, bzbackup, and bzreports) do not properly resolve links in the folders they traverse. A local user can create a link from Backblaze's folder to Windows OS system files during a backup; when the client follows the link, the affected machine can be rendered unbootable. Successful exploitation requires that an administrator-level system change has removed the specific Windows OS security controls that normally govern link resolution, allowing the link to be planted in this way. The impact is loss of availability of the whole system (high impact on the system's ability to boot), not data theft. Exploitation is not currently known: no public PoC exists, the flaw is not in CISA's KEV catalog, and EPSS puts 30-day exploitation probability at about 0.3%.
    · Backblaze Personal Computer Backup (Backblaze Client) for Windows, including the bzserv, bztransmit, bzfilelist, bzbackup, and bzrlarge

Appears with

product Backblaze Personal Computer Backup 5organization Zero Day Initiative 3vendor Zero Day Initiative 2
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.