Read the docs
TI-2026-08423 Aliases CVE-2026-9587GHSA-25gv-rxp9-h9pc

Authenticated Local File Inclusion (LFI) in Switchvox SMB Web Portal

Priority LOW 31CWE-73Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-73 and the CVSS impact.

Summary

An authenticated local file inclusion vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The play_file functionality accepts user-controlled input through the sound_path parameter and fails to properly validate file paths before accessing the underlying filesystem. By supplying absolute paths, an authenticated attacker can retrieve files outside the intended directory scope.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00378 32nd percentileScored 2026-11-07
Fix Fixed Switchvox SMB Edition (Sangoma): 8.4.0.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SangomaSwitchvox SMB Edition8.3 (104997) to before 8.4.0.28.4.0.2Patch availableCNA
  • Switchvox SMB Edition VendorSangoma Affected 8.3 (104997) to before 8.4.0.2 Fixed in 8.4.0.2 Patch available CNA

Remediation

  • Fix · CNA Switchvox SMB Edition (Sangoma) Fixed in 8.4.0.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Sangoma Switchvox SMB Edition 8.4.0.2

    4 records Highest priority Priority CRITICAL 1 CRITICAL, 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-08422 Unauthenticated SQL Injection Leading to Remote Code Execution in Switchvox SMBPriority CRITICAL 99
    • TI-2026-08421 Unauthenticated Reflected Cross-Site Scripting (XSS) in Switchvox SMB Web PortalPriority MEDIUM 40
    • TI-2026-08424 Authenticated Stored Cross-Site Scripting (XSS) in Switchvox SMB Web PortalPriority LOW 31
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-9587
  2. 2026-10-03 Alias added: GHSA-25gv-rxp9-h9pc

References

Advisory 1

Other 1

  • TI-2025-35702 FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE KEVCVSS 4.0CRITICAL 10.0
  • TI-2019-13698 Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control. KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-08422 Unauthenticated SQL Injection Leading to Remote Code Execution in Switchvox SMB KEVCVSS 4.0CRITICAL 9.3
  • TI-2025-39763 FreePBX Administration GUI is Vulnerable to Authenticated Command Injection KEVCVSS 4.0HIGH 8.6
  • TI-2025-30244 Using malformed From header can forge identity with ";" or NULL in name portion CVSS 3.1HIGH 7.7
  • TI-2024-38391 FreePBX 16 Authenticated Remote Code Execution via API Module CVSS 4.0HIGH 8.7
See all 97 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences