PT-2026-60811 · Sangoma · Switchvox Smb Edition

Cam Lischke · CVE-2026-9587 · Publicado 2026-07-17 · Atualizado 2026-07-17

NVD

CVSS v4.0

7.1

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

An authenticated local file inclusion vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The play file functionality accepts user-controlled input through the sound path parameter and fails to properly validate file paths before accessing the underlying filesystem. By supplying absolute paths, an authenticated attacker can retrieve files outside the intended directory scope.

Correção

Enumeração de Fraquezas

CWE-73

Identificadores relacionados

CVE-2026-9587

Produtos afetados

Switchvox Smb Edition

Referências · 3

• https://github.com/sangoma/security-switchvox/security/advisories/GHSA-mhp4-x83p-phh2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-9587 · Nota de Segurança
• https://labs.sra.io/posts/switchvox · Nota