CVE-2026-40342 - Vulnerability Analysis

Overview

Firebird < 5.0.4, 4.0.7, and 3.0.14 contains a command injection caused by unsafe concatenation of user-supplied engine name in external engine plugin loader, letting authenticated users with CREATE FUNCTION privileges execute arbitrary code via path traversal.

Severity & Score

Impact

Authenticated users with CREATE FUNCTION privileges can execute arbitrary code as the server OS account, leading to full system compromise.

Mitigation

Update to versions 5.0.4, 4.0.7, or 3.0.14 or later.

References

• https://github.com/FirebirdSQL/firebird/releases/tag/v4.0.7
• https://github.com/FirebirdSQL/firebird/releases/tag/v5.0.4
• https://github.com/FirebirdSQL/firebird/security/advisories/GHSA-7pxc-h3rv-r257
• https://github.com/FirebirdSQL/firebird/releases/tag/v3.0.14

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner