CVE-2026-40342

Name of the Vulnerable Software and Affected Versions Firebird versions prior to 5.0.4 Firebird versions prior to 4.0.7 Firebird versions prior to 3.0.14

Description The external engine plugin loader concatenates a user-supplied engine name into a filesystem path without filtering path separators or dot-dot (..) components. An authenticated user with CREATE FUNCTION privileges can use a crafted ENGINE parameter to perform path traversal and load an arbitrary shared library from any location on the filesystem. The initialization code of the library executes immediately upon loading, before the system validates the module, allowing for code execution under the server's operating system account.

Recommendations Update to version 5.0.4 Update to version 4.0.7 Update to version 3.0.14