Path Traversal Vulnerability in Firebird SQL Database Engine by Firebird
CVE-2026-40342
What is CVE-2026-40342?
Firebird SQL, an open-source relational database management system, suffers from a vulnerability allowing authenticated users with CREATE FUNCTION privileges to exploit a flaw in the external engine plugin loader. This flaw concatenates user-supplied engine names into filesystem paths without appropriate filtering, making way for attackers to load arbitrary shared libraries from any location on the filesystem through path traversal. When executed, the library's initialization code runs immediately, potentially leading to unauthorized code execution with the server's OS account. The issue has been addressed in versions 5.0.4, 4.0.7, and 3.0.14, highlighting the importance of updating to these secure versions.
Affected Version(s)
firebird < 3.0.14 < 3.0.14
firebird >= 4.0.0, < 4.0.7 < 4.0.0, 4.0.7
firebird >= 5.0.0, < 5.0.4 < 5.0.0, 5.0.4