What is GHSA-25gv-rxp9-h9pc?

GHSA-25gv-rxp9-h9pc is a security advisory published by GitHub Security Advisories with High severity. An authenticated local file inclusion vulnerability exists in Sangoma Switchvox SMB Edition 8.3 ...

Which CVE IDs does GHSA-25gv-rxp9-h9pc cover?

GHSA-25gv-rxp9-h9pc covers the following CVE IDs: CVE-2026-9587. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-25gv-rxp9-h9pcHigh

An authenticated local file inclusion vulnerability exists in Sangoma Switchvox SMB Edition 8.3 ...

Vendor

GitHub Security Advisories

Published

July 17, 2026

Last Modified

July 17, 2026

🔗 CVE IDs covered (1)

CVE-2026-9587 →

📋 Description

An authenticated local file inclusion vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The play_file functionality accepts user-controlled input through the sound_path parameter and fails to properly validate file paths before accessing the underlying filesystem. By supplying absolute paths, an authenticated attacker can retrieve files outside the intended directory scope.

🔗 References (4)

https://github.com/sangoma/security-switchvox/security/advisories/GHSA-mhp4-x83p-phh2
https://nvd.nist.gov/vuln/detail/CVE-2026-9587
https://labs.sra.io/posts/switchvox
https://github.com/advisories/GHSA-25gv-rxp9-h9pc