PT-2026-60811 · Sangoma · Switchvox Smb Edition

Cam Lischke · CVE-2026-9587 · Published 2026-07-17 · Updated 2026-07-17

Mitre

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

An authenticated local file inclusion vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The play file functionality accepts user-controlled input through the sound path parameter and fails to properly validate file paths before accessing the underlying filesystem. By supplying absolute paths, an authenticated attacker can retrieve files outside the intended directory scope.

Fix

Weakness Enumeration

CWE-73

Related Identifiers

CVE-2026-9587

Affected Products

Switchvox Smb Edition

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-9587 · Security Note
• https://labs.sra.io/posts/switchvox · Note
• https://github.com/sangoma/security-switchvox/security/advisories/GHSA-mhp4-x83p-phh2 · Note