CVE-2026-9587 Overview
CVE-2026-9587 is an authenticated local file inclusion (LFI) vulnerability in Sangoma Switchvox SMB Edition 8.3 (build 104997). The flaw resides in the play_file functionality, which accepts user-controlled input through the sound_path parameter without adequate path validation. An authenticated attacker can submit absolute filesystem paths to read files outside the intended sound directory. The weakness is tracked under CWE-73: External Control of File Name or Path and enables disclosure of sensitive host files accessible to the Switchvox web application user.
Critical Impact
Authenticated network-adjacent attackers can read arbitrary files on the Switchvox appliance, exposing configuration, credential, and system data used to escalate access within voice infrastructure.
Affected Products
- Sangoma Switchvox SMB Edition 8.3
- Sangoma Switchvox build 104997
- Switchvox play_file functionality processing the sound_path parameter
Discovery Timeline
- 2026-07-17 - CVE-2026-9587 published to NVD
- 2026-07-17 - Last updated in NVD database
Technical Details for CVE-2026-9587
Vulnerability Analysis
Switchvox exposes a play_file feature intended to play server-hosted audio files during call flows. The handler reads the sound_path parameter directly from an authenticated request and passes it to filesystem access routines. Because the code does not restrict the parameter to the designated sound library directory, an attacker can provide an absolute path such as /etc/passwd or paths to Switchvox configuration and database files. The application then returns or plays back the referenced content, effectively turning an audio playback feature into an arbitrary file read primitive.
Exploitation requires valid credentials, but any account with access to the affected functionality is sufficient. The attack is executed remotely over the network by sending a crafted request to the vulnerable endpoint. Successful exploitation impacts confidentiality only; integrity and availability of the appliance are not directly affected by this issue.
Root Cause
The root cause is missing canonicalization and allow-list validation on the sound_path parameter. The code trusts client-supplied paths and does not confine access to the intended audio directory, matching the CWE-73 pattern of external control of file name or path.
Attack Vector
An authenticated user submits an absolute path through the sound_path parameter to the play_file endpoint. The server dereferences the path and returns the file contents to the attacker. Refer to the SRA Labs Switchvox Analysis and the GitHub Security Advisory GHSA-mhp4-x83p-phh2 for endpoint specifics and reproduction steps.
No verified exploitation code is published. See the referenced advisory
and SRA Labs write-up for reproduction details.
Detection Methods for CVE-2026-9587
Indicators of Compromise
- Web server or application logs containing sound_path values with absolute paths such as /etc/, /var/, or /root/.
- Requests to the play_file endpoint from user accounts that do not normally invoke call-flow audio features.
- Unusually large or non-audio response payloads returned by play_file requests.
Detection Strategies
- Inspect HTTP request logs for occurrences of sound_path=/ or URL-encoded equivalents (%2F) targeting the play_file handler.
- Correlate authenticated Switchvox sessions with requests reading system files, and flag deviations from baseline administrator behavior.
- Alert on repeated play_file calls from the same session that reference varying absolute paths, indicating enumeration.
Monitoring Recommendations
- Forward Switchvox web and application logs to a central SIEM or log platform for retention and search.
- Monitor authentication events for compromised or brute-forced credentials that could enable this vulnerability.
- Track outbound data volumes from the Switchvox management interface to identify bulk file exfiltration.
How to Mitigate CVE-2026-9587
Immediate Actions Required
- Restrict administrative and user access to the Switchvox web interface to trusted management networks only.
- Rotate credentials for all Switchvox accounts and disable unused or shared accounts.
- Review historical logs for prior exploitation attempts against the play_file endpoint.
Patch Information
Consult the Sangoma GitHub Security Advisory GHSA-mhp4-x83p-phh2 for the vendor's fixed build information and upgrade guidance for Switchvox SMB Edition 8.3 (104997). Apply the vendor-provided update as soon as it is available for your deployment.
Workarounds
- Place the Switchvox management interface behind a VPN or firewall rule set that restricts access to a small set of administrator source addresses.
- Enforce least-privilege role assignments so that only accounts requiring call-flow configuration can reach the play_file functionality.
- Enable multi-factor authentication where supported to reduce the risk of credential misuse.
# Example: restrict Switchvox admin interface to a management subnet
iptables -A INPUT -p tcp --dport 443 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
