CVE-2026-9587 - Authenticated Local File Inclusion (LFI) in Switchvox SMB Web Portal

Back Back to CVE browser

HIGH

Authenticated Local File Inclusion (LFI) in Switchvox SMB Web Portal

Published Jul 17, 2026

7.1

HIGH

CVSS 4.0

EPSS 0.38%

Description

An authenticated local file inclusion vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The play_file functionality accepts user-controlled input through the sound_path parameter and fails to properly validate file paths before accessing the underlying filesystem. By supplying absolute paths, an authenticated attacker can retrieve files outside the intended directory scope.

Affected products

Vendor Sangoma Product Switchvox SMB Edition Default
unaffected
- Version
  8.3 (104997)
  Status
  affected
  Constraints
  <8.4.0.2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Sangoma

Switchvox SMB Edition

unaffected

Version	Status	Constraints
8.3 (104997)	affected	<8.4.0.2

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-73

References (2)

https://github.com/sangoma/security-switchvox/security/advisories/GHSA-mhp4-x83p-phh2
release-notes
https://labs.sra.io/posts/switchvox/
third-party-advisory

Link	Providers	Tags
https://github.com/sangoma/security-switchvox/security/advisories/GHSA-mhp4-x83p-phh2		release-notes
https://labs.sra.io/posts/switchvox/		third-party-advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner SRA

Published Jul 17, 2026

Updated Jul 17, 2026

Reserved May 26, 2026

Link CVE-2026-9587

CISA Vulnrichment

Updated Jul 17, 2026

NVD

Status Deferred

Modified Jul 17, 2026

Link CVE-2026-9587

Red Hat

Severity n/a

Public date n/a

Links CVE-2026-9587