Firebird Database Vulnerability Allows RCE via Path Traversal
The National Vulnerability Database has detailed a critical vulnerability (CVE-2026-40342) in the open-source Firebird relational database system. Versions prior to 5.0.4, 4.0.7, and 3.0.14 are affected. An authenticated user with CREATE FUNCTION privileges can exploit this by supplying a malicious engine name. This name is concatenated into a filesystem path without proper sanitization, allowing for path traversal. The attacker can then load an arbitrary shared library from anywhere on the system, leading to immediate code execution with the privileges of the Firebird server OS account.
What This Means For You
- If your organization uses Firebird versions prior to 5.0.4, 4.0.7, or 3.0.14, you must patch immediately. This vulnerability allows an authenticated attacker with minimal privileges to achieve critical remote code execution by loading their own malicious libraries. Prioritize upgrading to the fixed versions to mitigate this severe risk.
Related ATT&CK Techniques
🛡️ Detection Rules
3 rules · 6 SIEM formats3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
CVE-2026-40342 - Firebird RCE via Path Traversal Plugin Load
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-40342 | Path Traversal | Firebird RDBMS external engine plugin loader |
| CVE-2026-40342 | RCE | Firebird RDBMS versions < 5.0.4, < 4.0.7, < 3.0.14 |
| CVE-2026-40342 | Code Execution | Authenticated user with CREATE FUNCTION privileges |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | April 17, 2026 at 23:16 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related Posts
Radare2 Command Injection Flaw Exposes Analysis Workflow
CVE-2026-40527 — radare2 prior to commit bc5a890 contains a command injection vulnerability in the afsv/afsvj command path where crafted ELF binaries can embed malicious r2...
zrok Heap Overflow: Unauthenticated DoS Risk
CVE-2026-40303 — zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, endpoints.GetSessionCookie parses an attacker-supplied cookie chunk count and...
CVE-2026-40302 — zrok is software for sharing web services, files, and
CVE-2026-40302 — zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, the proxyUi template engine uses Go's text/template (which...