EUVD-2026-45206
GHSA-25gv-rxp9-h9pc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable authenticated endpoint (PR:L) with low complexity yields high confidentiality file disclosure only; no integrity or availability impact and no scope change.
Primary rating from Vendor (SRA).
CVSS VectorVendor: SRA
Lifecycle Timeline
3DescriptionCVE.org
An authenticated local file inclusion vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The play_file functionality accepts user-controlled input through the sound_path parameter and fails to properly validate file paths before accessing the underlying filesystem. By supplying absolute paths, an authenticated attacker can retrieve files outside the intended directory scope.
AnalysisAI
Arbitrary file read in Sangoma Switchvox SMB Edition 8.3 (build 104997) allows an authenticated user to disclose sensitive files anywhere on the appliance filesystem. The play_file functionality trusts the user-controlled sound_path parameter and fails to validate paths, so supplying an absolute path escapes the intended sound directory. No public exploit code is identified, but a detailed technical write-up from the reporting researchers (SRA) exists, and the flaw is not listed in CISA KEV.
Technical ContextAI
Switchvox is a Sangoma IP-PBX/unified-communications appliance for small and medium businesses, built around Asterisk-style telephony with a web administration interface. The vulnerable play_file routine is intended to play audio prompts from a bounded sound directory, but it takes the sound_path parameter directly from the request and passes it to filesystem access without canonicalization or allow-listing. This maps to CWE-73 (External Control of File Name or Path): because the caller controls the full path, absolute references such as /etc/passwd or configuration and credential files are resolved and returned, defeating the intended directory scoping.
RemediationAI
Patch available per vendor advisory: apply the fix described in Sangoma's GitHub security advisory GHSA-mhp4-x83p-phh2 (https://github.com/sangoma/security-switchvox/security/advisories/GHSA-mhp4-x83p-phh2); no exact fixed build number is given in the provided data, so confirm the patched version directly with Sangoma before deploying. As compensating controls until patched, restrict access to the Switchvox administrative/web interface to trusted management networks or VPN only (limiting who can reach the authenticated play_file endpoint), tighten and audit user accounts to reduce the pool of low-privileged users who could abuse the flaw, and monitor web/access logs for requests to play_file containing absolute paths (e.g. sound_path values beginning with '/'). These network-restriction controls reduce exposure but do not remove the vulnerability for legitimate authenticated users, and aggressive account lockdown may disrupt normal administration.
More in Switchvox Smb Edition
View allUnauthenticated SQL injection in Sangoma Switchvox SMB Edition 8.3 (build 104997) lets remote attackers execute arbitrar
Reflected cross-site scripting in Sangoma Switchvox SMB Edition 8.3 (build 104997) lets an unauthenticated remote attack
Stored cross-site scripting in Sangoma Switchvox SMB Edition 8.3 (build 104997) lets an authenticated user inject persis
Same weakness CWE-73 – External Control of File Name or Path
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today