A vulnerability in Backblaze Client for Windows allows a local user to create a link from the client’s folder to critical Windows OS system files while a backup is running. The improper resolution of these links can overwrite or bypass security controls and leave the system unable to boot. The issue stems from insufficient validation of link targets and the ability to write to protected directories.

Backblaze Backblaze Client for Windows. No specific version information is reported; all installations that use the default backup folder may be affected.

The CVSS score of 5.8 indicates a moderate risk. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited public exploitation data. Successful exploitation requires the attacker to have administrator‑level access or the ability to perform an administrative change that removes specific Windows security controls. Once the exploit is carried out, the machine’s boot process is disrupted, which results in a local denial of service. The overall risk is therefore moderate, with impact limited to instances where the attacker can influence the backup configuration on a compromised system.