Vulnerability in Sangoma Switchvox SMB Edition
CVE-2026-9587
An authenticated local file inclusion vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The play_file functionality accepts user-controlled input through the sound_path parameter and fails to properly validate file paths before accessing the underlying filesystem. By supplying absolute paths, an authenticated attacker can retrieve files outside the intended directory scope.
EPSS: 0.004 (30.7th percentile) — read the EPSS interpretation.
Affected products
- Sangoma Switchvox Smb Edition — versions 8.3 (104997)
Weakness classification (CWE)
References
- 57dba5dd-1a03-47f6-8b36-e84e47d335d8 (release-notes)
- 57dba5dd-1a03-47f6-8b36-e84e47d335d8 (third-party-advisory)