---
cve: "CVE-2026-40342"
severity: "CRITICAL"
cvss: 10.0
epss: "0.7%"
vendor: "FirebirdSQL"
kev: false
exploited: false
published: "2026-04-17 20:16:35"
tags: [cve, security, critical]
source: tsecurity.de CVE-Dossier
exported: "2026-11-10T17:53:12+01:00"
---

# CVE-2026-40342

> 10.0 CRITICAL · 🧪 PoC

## Beschreibung

Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the external engine plugin loader concatenates a user-supplied engine name into a filesystem path without filtering path separators or .. components. An authenticated user with CREATE FUNCTION privileges can use a crafted ENGINE name to load an arbitrary shared library from anywhere on the filesystem via path traversal. The library's initialization code executes immediately during loading, before Firebird validates the module, achieving code execution as the server's OS account. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14.

## CNA-Record (Kanon, cvelistV5)

- CNA: **GitHub_M**
- State: PUBLISHED
- Stand: 2026-04-22 13:56:49
- CNA-CVSS: **10.0** (`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **no**
  - Technical Impact: **total**

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Gering | warn |
| UI Interaktion | Keine | bad |
| S Scope | Verändert | bad |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Hoch | bad |

## Schwachstellen-Klasse

- **CWE-22** — Improper Limitation of a Pathname to a Restricted Directory
  The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
- **CWE-427** — Uncontrolled Search Path Element
  The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
- **CWE-73** — External Control of File Name or Path
  The product allows user input to control or influence paths or file names that are used in filesystem operations.
- **CWE-94** — Improper Control of Generation of Code
  The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

## Angriffsmuster (CAPEC)

- [CAPEC-64 — Using Slashes and URL Encoding Combined to Bypass Validation Logic](https://capec.mitre.org/data/definitions/64.html) _(Severity: High)_
- [CAPEC-76 — Manipulating Web Input to File System Calls](https://capec.mitre.org/data/definitions/76.html) _(Severity: Very High)_
- [CAPEC-78 — Using Escaped Slashes in Alternate Encoding](https://capec.mitre.org/data/definitions/78.html) _(Severity: High)_
- [CAPEC-79 — Using Slashes in Alternate Encoding](https://capec.mitre.org/data/definitions/79.html) _(Severity: High)_
- [CAPEC-126 — Path Traversal](https://capec.mitre.org/data/definitions/126.html) _(Severity: Very High)_

## Patch verfügbar (OSV)

- 463bae029a4426deff7e9bb08a8317aaa398c7c7 (Commit)
- 26f6881c9eac77c5e3166d209682c0ebe8dd07c0 (Commit)

## BSI-Hinweise (deutsch)

- [Firebird: Mehrere Schwachstellen](https://wid.cert-bund.de/portal/wid/sicherheitshinweis/WID-SEC-W-2026-1171) — _BSI-Einstufung: hoch_
  Ein Angreifer kann mehrere Schwachstellen in Firebird ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.

## Referenzen

- <https://github.com/FirebirdSQL/firebird/security/advisories/GHSA-7pxc-h3rv-r257>
- <https://github.com/FirebirdSQL/firebird/releases/tag/v3.0.14>
- <https://github.com/FirebirdSQL/firebird/releases/tag/v4.0.7>
- <https://github.com/FirebirdSQL/firebird/releases/tag/v5.0.4>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-40342/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_