CVE-2026-9587

Description

An authenticated local file inclusion vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The play_file functionality accepts user-controlled input through the sound_path parameter and fails to properly validate file paths before accessing the underlying filesystem. By supplying absolute paths, an authenticated attacker can retrieve files outside the intended directory scope.

References

• https://github.com/sangoma/security-switchvox/security/advisories/GHSA-mhp4-x83p-phh2
• https://labs.sra.io/posts/switchvox/