High severity · published Jul 17, 2026
CVE-2026-9587
Authenticated Local File Inclusion (LFI) in Switchvox SMB Web Portal
7.1
CVSS
0.4%
EPSS
No
On KEV
Description
An authenticated local file inclusion vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The play_file functionality accepts user-controlled input through the sound_path parameter and fails to properly validate file paths before accessing the underlying filesystem. By supplying absolute paths, an authenticated attacker can retrieve files outside the intended directory scope.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SS
Switchvox SMB Edition · Sangoma
8.3 (104997) before 8.4.0.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-9587
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-9587
github.com
https://github.com/sangoma/security-switchvox/security/advisories/GHSA-mhp4-x83p-phh2
labs.sra.io
https://labs.sra.io/posts/switchvox/
More from Switchvox SMB Edition
9.8
CVE-2026-9586
Unauthenticated SQL Injection Leading to Remote Code Execution in Switchvox SMB
8.6
CVE-2026-9585
Unauthenticated Reflected Cross-Site Scripting (XSS) in Switchvox SMB Web Portal
7.0
CVE-2026-9588
Authenticated Stored Cross-Site Scripting (XSS) in Switchvox SMB Web Portal