An authenticated user with specific privileges can achieve arbitrary code execution in Firebird databases by exploiting a path traversal vulnerability in the plugin loader.

The external engine plugin loader fails to sanitize user-supplied engine names, allowing an authenticated attacker with CREATE FUNCTION privileges to perform path traversal. This allows the loading of arbitrary shared libraries, which execute during initialization with the permissions of the database server process.

With a CVSS score of 9.9, this vulnerability represents an critical risk to the underlying host server. An attacker capable of executing arbitrary code with the privileges of the database service can fully compromise the host operating system, access all stored data, and potentially pivot into the internal network.

Immediate Action: Update Firebird to versions 5.0.4, 4.0.7, or 3.0.14 as appropriate for your deployment.

Proactive Monitoring: Audit database privileges to ensure that only trusted users are granted CREATE FUNCTION rights and monitor for unexpected shared library loading activities.

Compensating Controls: Restrict the service account permissions of the Firebird database process to the minimum level necessary, following the principle of least privilege.

Public Exploit Available: No

Given the potential for complete system compromise, immediate patching is required. Organizations should also review existing user roles to ensure that administrative privileges are strictly limited to authorized personnel to mitigate the impact of internal threats.