CVE-2026-40342

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-40342
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40342.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-40342
Aliases
  • GHSA-7pxc-h3rv-r257
Downstream
Related
Published
2026-04-17T19:22:46.644Z
Modified
2026-07-08T07:34:12.105339524Z
Severity
  • 9.9 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
Firebird: Path Traversal + Arbitrary File Write Leads to Remote Code Execution
Details

Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the external engine plugin loader concatenates a user-supplied engine name into a filesystem path without filtering path separators or .. components. An authenticated user with CREATE FUNCTION privileges can use a crafted ENGINE name to load an arbitrary shared library from anywhere on the filesystem via path traversal. The library's initialization code executes immediately during loading, before Firebird validates the module, achieving code execution as the server's OS account. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40342.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-22",
        "CWE-427",
        "CWE-73",
        "CWE-94"
    ]
}
References

Affected packages

Git / github.com/firebirdsql/firebird

Affected ranges

Type
GIT
Repo
https://github.com/firebirdsql/firebird
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
463bae029a4426deff7e9bb08a8317aaa398c7c7
Introduced
141bb5491d24cb363f03c5a0786a32f73a1faa5b
Fixed
26f6881c9eac77c5e3166d209682c0ebe8dd07c0
Introduced
af1546f15fa871b313ebcc7df1fd2df3c396c616
Fixed
f6d83a28c009ab039ea40ffdb4ccc58f190dfbe6
Database specific 
{
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:firebirdsql:firebird:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.0.14"
        },
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.0.7"
        },
        {
            "introduced": "5.0.0"
        },
        {
            "fixed": "5.0.4"
        }
    ]
}

Affected versions

Other
R3_0_0
R3_0_1
R3_0_2
R3_0_3
R3_0_4
R3_0_5
R3_0_6
R3_0_7
v3.*
v3.0.10
v3.0.11
v3.0.12
v3.0.13
v3.0.8
v3.0.9
v4.*
v4.0.0
v4.0.1
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v5.*
v5.0.0
v5.0.1
v5.0.2
v5.0.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40342.json"