CVE-2026-40342 - Firebird: Path Traversal + Arbitrary File Write Leads to Remote Code Execution

Back Back to CVE browser

CRITICAL

Firebird: Path Traversal + Arbitrary File Write Leads to Remote Code Execution

Published Apr 17, 2026

10.0

CRITICAL

CVSS 3.1

EPSS 0.84%

Description

Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the external engine plugin loader concatenates a user-supplied engine name into a filesystem path without filtering path separators or .. components. An authenticated user with CREATE FUNCTION privileges can use a crafted ENGINE name to load an arbitrary shared library from anywhere on the filesystem via path traversal. The library's initialization code executes immediately during loading, before Firebird validates the module, achieving code execution as the server's OS account. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.

Affected products

Vendor FirebirdSQL Product Firebird Default
n/a
- Version
  < 3.0.14
  Status
  affected
  Constraints
  -
- Version
  >= 4.0.0, < 4.0.7
  Status
  affected
  Constraints
  -
- Version
  >= 5.0.0, < 5.0.4
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

FirebirdSQL

Firebird

n/a

Version	Status	Constraints
< 3.0.14	affected	-
>= 4.0.0, < 4.0.7	affected	-
>= 5.0.0, < 5.0.4	affected	-

Remediation

No remediation recorded yet.

Weaknesses (4)

CWE-22

Path Traversal

CWE-427

CWE-73

CWE-94

Code Injection

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-23496
Advisory
https://github.com/FirebirdSQL/firebird/releases/tag/v3.0.14
x_refsource_MISCRelease Notes
https://github.com/FirebirdSQL/firebird/releases/tag/v4.0.7
x_refsource_MISCRelease Notes
https://github.com/FirebirdSQL/firebird/releases/tag/v5.0.4
x_refsource_MISCRelease Notes
https://github.com/FirebirdSQL/firebird/security/advisories/GHSA-7pxc-h3rv-r257
x_refsource_CONFIRMExploitVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-23496		Advisory
https://github.com/FirebirdSQL/firebird/releases/tag/v3.0.14		x_refsource_MISCRelease Notes
https://github.com/FirebirdSQL/firebird/releases/tag/v4.0.7		x_refsource_MISCRelease Notes
https://github.com/FirebirdSQL/firebird/releases/tag/v5.0.4		x_refsource_MISCRelease Notes
https://github.com/FirebirdSQL/firebird/security/advisories/GHSA-7pxc-h3rv-r257		x_refsource_CONFIRMExploitVendor Advisory