CVE-2026-9587

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-9587", "assignerOrgId": "57dba5dd-1a03-47f6-8b36-e84e47d335d8", "state": "PUBLISHED", "assignerShortName": "SRA", "dateReserved": "2026-05-26T13:03:31.955Z", "datePublished": "2026-07-17T15:58:25.588Z", "dateUpdated": "2026-07-17T16:42:37.099Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "57dba5dd-1a03-47f6-8b36-e84e47d335d8", "shortName": "SRA", "dateUpdated": "2026-07-17T15:58:25.588Z"}, "title": "Authenticated Local File Inclusion (LFI) in Switchvox SMB Web Portal", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-73", "description": "CWE-73 External control of file name or path", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-126", "descriptions": [{"lang": "en", "value": "CAPEC-126 Path Traversal"}]}], "affected": [{"vendor": "Sangoma", "product": "Switchvox SMB Edition", "versions": [{"status": "affected", "version": "8.3 (104997)", "lessThan": "8.4.0.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "An authenticated local file inclusion vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The play_file functionality accepts user-controlled input through the sound_path parameter and fails to properly validate file paths before accessing the underlying filesystem. By supplying absolute paths, an authenticated attacker can retrieve files outside the intended directory scope.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div><div>An authenticated local file inclusion vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The play_file functionality accepts user-controlled input through the sound_path parameter and fails to properly validate file paths before accessing the underlying filesystem. By supplying absolute paths, an authenticated attacker can retrieve files outside the intended directory scope.</div></div>"}]}], "references": [{"url": "https://github.com/sangoma/security-switchvox/security/advisories/GHSA-mhp4-x83p-phh2", "tags": ["release-notes"]}, {"url": "https://labs.sra.io/posts/switchvox/", "tags": ["third-party-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 7.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "Cam Lischke (SRA)", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-17T16:42:28.788088Z", "id": "CVE-2026-9587", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-17T16:42:37.099Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-9587", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-17T16:42:28.788088Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-17T16:42:32.375Z"}}], "cna": {"title": "Authenticated Local File Inclusion (LFI) in Switchvox SMB Web Portal", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Cam Lischke (SRA)"}], "impacts": [{"capecId": "CAPEC-126", "descriptions": [{"lang": "en", "value": "CAPEC-126 Path Traversal"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Sangoma", "product": "Switchvox SMB Edition", "versions": [{"status": "affected", "version": "8.3 (104997)", "lessThan": "8.4.0.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/sangoma/security-switchvox/security/advisories/GHSA-mhp4-x83p-phh2", "tags": ["release-notes"]}, {"url": "https://labs.sra.io/posts/switchvox/", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "An authenticated local file inclusion vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The play_file functionality accepts user-controlled input through the sound_path parameter and fails to properly validate file paths before accessing the underlying filesystem. By supplying absolute paths, an authenticated attacker can retrieve files outside the intended directory scope.", "supportingMedia": [{"type": "text/html", "value": "<div><div>An authenticated local file inclusion vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The play_file functionality accepts user-controlled input through the sound_path parameter and fails to properly validate file paths before accessing the underlying filesystem. By supplying absolute paths, an authenticated attacker can retrieve files outside the intended directory scope.</div></div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-73", "description": "CWE-73 External control of file name or path"}]}], "providerMetadata": {"orgId": "57dba5dd-1a03-47f6-8b36-e84e47d335d8", "shortName": "SRA", "dateUpdated": "2026-07-17T15:58:25.588Z"}}}, "cveMetadata": {"cveId": "CVE-2026-9587", "state": "PUBLISHED", "dateUpdated": "2026-07-17T16:42:37.099Z", "dateReserved": "2026-05-26T13:03:31.955Z", "assignerOrgId": "57dba5dd-1a03-47f6-8b36-e84e47d335d8", "datePublished": "2026-07-17T15:58:25.588Z", "assignerShortName": "SRA"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Switchvox SMB Edition", "vendor": "Sangoma", "versions": [{"lessThan": "8.4.0.2", "status": "affected", "version": "8.3 (104997)", "versionType": "semver"}]}], "source": "57dba5dd-1a03-47f6-8b36-e84e47d335d8"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An authenticated local file inclusion vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The play_file functionality accepts user-controlled input through the sound_path parameter and fails to properly validate file paths before accessing the underlying filesystem. By supplying absolute paths, an authenticated attacker can retrieve files outside the intended directory scope."}, {"lang": "es", "value": "Una vulnerabilidad de inclusi\u00f3n local de ficheros autenticada existe en Sangoma Switchvox SMB Edition 8.3 (104997). La funcionalidad play_file acepta entrada controlada por el usuario a trav\u00e9s del par\u00e1metro sound_path y no valida correctamente las rutas de los ficheros antes de acceder al sistema de ficheros subyacente. Al proporcionar rutas absolutas, un atacante autenticado puede recuperar ficheros fuera del \u00e1mbito del directorio previsto."}], "id": "CVE-2026-9587", "lastModified": "2026-10-24T20:10:00.137", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "57dba5dd-1a03-47f6-8b36-e84e47d335d8", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-9587", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-17T16:42:28.788088Z", "version": "2.0.3"}}]}, "published": "2026-07-17T17:17:18.280", "references": [{"source": "57dba5dd-1a03-47f6-8b36-e84e47d335d8", "url": "https://github.com/sangoma/security-switchvox/security/advisories/GHSA-mhp4-x83p-phh2"}, {"source": "57dba5dd-1a03-47f6-8b36-e84e47d335d8", "url": "https://labs.sra.io/posts/switchvox/"}], "sourceIdentifier": "57dba5dd-1a03-47f6-8b36-e84e47d335d8", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-73"}], "source": "57dba5dd-1a03-47f6-8b36-e84e47d335d8", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[8.3 (104997),8.4.0.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Switchvox SMB Edition", "source": "cna", "vendor": "Sangoma"}, "product": "switchvox_smb_edition", "vendor": "sangoma"}], "created": "2026-07-22T20:15:03.166327+00:00", "updated": "2026-07-31T00:15:05.758267+00:00", "vendors": ["sangoma", "sangoma$PRODUCT$switchvox_smb_edition"]}