CVE-2026-40342

CVE-2026-40342 is a critical path traversal vulnerability in Firebird relational database management system versions prior to 5.0.4, 4.0.7, and 3.0.14. The flaw exists in the external engine plugin loader, which fails to properly sanitize user-supplied engine names, allowing authenticated users with CREATE FUNCTION privileges to load arbitrary shared libraries from any location on the filesystem and execute code with database server privileges. The vulnerability carries a CVSS score of 9.9 (Critical) with a network-based attack vector requiring low complexity and low privileges but no user interaction needed. The impact is severe, encompassing complete compromise of confidentiality, integrity, and availability across the system boundary. Exploitation requires valid database credentials but no additional technical barriers exist once an attacker gains basic authentication access. There is currently no evidence of active exploitation in the wild, as indicated by the vulnerability's absence from the CISA KEV catalog and inactive status on security hot lists. The EPSS score of 0.00085 suggests exploitation is currently unlikely relative to other disclosed vulnerabilities, though organizations running affected versions should prioritize patching to eliminate this high-severity threat.