CVE-2026-9587

High

Description

An authenticated local file inclusion vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The play_file functionality accepts user-controlled input through the sound_path parameter and fails to properly validate file paths before accessing the underlying filesystem. By supplying absolute paths, an authenticated attacker can retrieve files outside the intended directory scope.

SeverityHigh

CVSS7.1

Exploit probability—

ProductSwitchvox SMB Edition

PublishedJul 17, 2026

First seenJul 17, 2026

Weakness typeCWE-73CWE-73

How to fix

Update

Sangoma Switchvox SMB Edition8.4.0.2 or later

Vendor advisories

github.com/sangoma/security-switchvox/security/advisories/GHSA-mhp4-x83p-phh2

Affected products

Product	Affected versions	Fixed in
Sangoma Switchvox SMB Edition	8.3 (104997) ≤ v < 8.4.0.2	8.4.0.2

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.