CVE-2026-9587
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
An authenticated local file inclusion vulnerability in Sangoma Switchvox SMB Edition 8.3 allows reading arbitrary files via the play_file function. The sound_path parameter lacks proper validation, enabling absolute path traversal.
Risk Assessment
An attacker can access sensitive data such as configurations, passwords, or system logs, leading to confidentiality breaches and potential privilege escalation.
Recommendation
Upgrade Sangoma Switchvox to the latest patched version immediately. As a workaround, restrict administrative interface access to trusted IP addresses only.
Other vulnerabilities in Sangoma Switchvox
Original NVD description (English source)
An authenticated local file inclusion vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The play_file functionality accepts user-controlled input through the sound_path parameter and fails to properly validate file paths before accessing the underlying filesystem. By supplying absolute paths, an authenticated attacker can retrieve files outside the intended directory scope.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS