CVE-2026-9587Authenticated Local File Inclusion (LFI) in Switchvox SMB Web Portal

Beschreibung

An authenticated local file inclusion vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The play_file functionality accepts user-controlled input through the sound_path parameter and fails to properly validate file paths before accessing the underlying filesystem. By supplying absolute paths, an authenticated attacker can retrieve files outside the intended directory scope.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• https://github.com/sangoma/security-switchvox/security/advisories/GHSA-mhp4-x83p-phh2 release-notes
• https://labs.sra.io/posts/switchvox/ third-party-advisory