CVE-2026-9587 – Authenticated Local File Inclusion (LFI) in Switchvox SMB Web Portal

CVE ID :CVE-2026-9587

Published : July 17, 2026, 5:17 p.m. | 21 minutes ago

Description :An authenticated local file inclusion vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The play_file functionality accepts user-controlled input through the sound_path parameter and fails to properly validate file paths before accessing the underlying filesystem. By supplying absolute paths, an authenticated attacker can retrieve files outside the intended directory scope.

Severity: 7.1 | HIGH

Visit the link for more details, such as CVSS details, affected products, timeline, and more…