CVE-2026-9587Authenticated Local File Inclusion (LFI) in Switchvox SMB Web Portal

Açıklama

An authenticated local file inclusion vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The play_file functionality accepts user-controlled input through the sound_path parameter and fails to properly validate file paths before accessing the underlying filesystem. By supplying absolute paths, an authenticated attacker can retrieve files outside the intended directory scope.

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Kaynaklar ve yamalar

• https://github.com/sangoma/security-switchvox/security/advisories/GHSA-mhp4-x83p-phh2 release-notes
• https://labs.sra.io/posts/switchvox/ third-party-advisory