CVE-2026-40342

Description

Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the external engine plugin loader concatenates a user-supplied engine name into a filesystem path without filtering path separators or .. components. An authenticated user with CREATE FUNCTION privileges can use a crafted ENGINE name to load an arbitrary shared library from anywhere on the filesystem via path traversal. The library-s initialization code executes immediately during loading, before Firebird validates the module, achieving code execution as the server-s OS account. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.