CVE-2026-9587CWE-73

Authenticated Local File Inclusion (LFI) in Switchvox SMB Web Portal

High · published July 17, 2026

CVSS v4.0
7.1
EPSS
0%
Percentile
30.6
In the wild
Unconfirmed
What it is

An authenticated local file inclusion vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The play_file functionality accepts user-controlled input through the sound_path parameter and fails to properly validate file paths before accessing the underlying filesystem. By supplying absolute paths, an authenticated attacker can retrieve files outside the intended directory scope.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00378 · 30.6th percentile
Weakness
CWE-73 · External Control of File Name or Path
Published
2026-07-17T15:58Z
EPSS history
Timeline
  • 17 JUL 15:58Z
    Authenticated Local File Inclusion (LFI) in Switchvox SMB Web Portal
    cvelistv5