CVE-2026-9587Authenticated Local File Inclusion (LFI) in Switchvox SMB Web Portal

Descripción

An authenticated local file inclusion vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The play_file functionality accepts user-controlled input through the sound_path parameter and fails to properly validate file paths before accessing the underlying filesystem. By supplying absolute paths, an authenticated attacker can retrieve files outside the intended directory scope.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• https://github.com/sangoma/security-switchvox/security/advisories/GHSA-mhp4-x83p-phh2 release-notes
• https://labs.sra.io/posts/switchvox/ third-party-advisory