Vulnerability · Published Jul 17, 2026 · Assigned by SRA

CVE-2026-9587Authenticated Local File Inclusion (LFI) in Switchvox SMB Web Portal

High 7.1

In plain English

A high-severity security flaw in Switchvox SMB Edition from Sangoma. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).

Severity (CVSS 4.0)7.1High

Exploit odds (30 days)0.4%top 68.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An authenticated local file inclusion vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The play_file functionality accepts user-controlled input through the sound_path parameter and fails to properly validate file paths before accessing the underlying filesystem. By supplying absolute paths, an authenticated attacker can retrieve files outside the intended directory scope.

Affected products (as reported)

Vendor	Product	Versions
Sangoma	Switchvox SMB Edition	8.3 (104997) – before 8.4.0.2

Weakness: CWE-73 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://github.com/sangoma/security-switchvox/security/advisories/GHSA-mhp4-x83p-phh2 release-notes
https://labs.sra.io/posts/switchvox/ third-party-advisory