CVE-2026-40342: firebirdsql firebird Path Traversal

Vulnerability summary

CVE-2026-40342 is a critical (CVSS 10.0) Path Traversal vulnerability in firebirdsql firebird. EPSS estimates a 0.84% chance of exploitation in the next 30 days, higher than 57.5% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 17-04-2026
   PublishedVulnerability first disclosed.
2. 22-04-2026
   Last modifiedVulnerability information updated.

Description

Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the external engine plugin loader concatenates a user-supplied engine name into a filesystem path without filtering path separators or .. components. An authenticated user with CREATE FUNCTION privileges can use a crafted ENGINE name to load an arbitrary shared library from anywhere on the filesystem via path traversal. The library's initialization code executes immediately during loading, before Firebird validates the module, achieving code execution as the server's OS account. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.

• CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
• CWE-73External Control of File Name or PathThe product allows user input to control or influence paths or file names that are used in filesystem operations.
• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
• CWE-427Uncontrolled Search Path ElementThe product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.