Firebird versions earlier than 5.0.4, 4.0.7, and 3.0.14 allow an authenticated user with CREATE FUNCTION privileges to craft an ENGINE name that is concatenated into a filesystem path without filtering path separators or .. components. This path traversal bug enables the attacker to load an arbitrary shared library from any location on the host. When the library is loaded, its initialization code runs immediately, before Firebird performs any module validation, resulting in code execution under the server’s operating‑system account. The vulnerability is classified under CWE‑22, CWE‑427, CWE‑73 and CWE‑94, and carries a CVSS score of 10.

FirebirdSQL: firebird in versions prior to 5.0.4, 4.0.7 and 3.0.14 are affected. The issue is fixed in the indicated release versions.

The CVSS score of 10 indicates a very high severity and a low attack complexity; an attacker who can authenticate and has CREATE FUNCTION rights can exploit the flaw by creating a malicious shared library. The EPSS score is not available, but the lack of a defensive check and the high CVSS score suggest that exploitation is likely should an attacker obtain the necessary privileges. The flaw is not listed in the CISA KEV catalog, yet the exploitation potential makes it a critical risk for any environment running the affected Firebird releases.