ZDI-26-626: Backblaze Personal Computer Backup bzfilelist Link Following Denial-of-Service Vulnerability

CVE-2026-19820 is a link-following flaw (CWE-59) in the Backblaze Personal Computer Backup client for Windows, whose backup components (bzserv, bztransmit, bzfilelist, bzbackup, and bzreports) do not properly resolve links in the folders they traverse. A local user can create a link from Backblaze's folder to Windows OS system files during a backup; when the client follows the link, the affected machine can be rendered unbootable. Successful exploitation requires that an administrator-level system change has removed the specific Windows OS security controls that normally govern link resolution, allowing the link to be planted in this way. The impact is loss of availability of the whole system (high impact on the system's ability to boot), not data theft. Exploitation is not currently known: no public PoC exists, the flaw is not in CISA's KEV catalog, and EPSS puts 30-day exploitation probability at about 0.3%.

Do: Update the Backblaze Personal Backup client to the latest vendor release addressing the link-following issues once a fixed version is published (see Backblaze/ZDI advisories ZDI-26-624 through ZDI-26-628). In the meantime, verify that the machine retains the standard Windows security controls around link creation — the flaw requires an administrator-level change that removed them — and restrict which local users can create symlinks or junctions. No in-the-wild exploitation is reported, but monitor Backblaze's advisories for a patched build.