What is GHSA-m32j-v93f-gfgc?

GHSA-m32j-v93f-gfgc is a security advisory published by GitHub Security Advisories with Critical severity. An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 ...

Which CVE IDs does GHSA-m32j-v93f-gfgc cover?

GHSA-m32j-v93f-gfgc covers the following CVE IDs: CVE-2026-9586. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-m32j-v93f-gfgcCritical

An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 ...

Vendor

GitHub Security Advisories

Published

July 17, 2026

Last Modified

July 17, 2026

🔗 CVE IDs covered (1)

CVE-2026-9586 →

📋 Description

An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-9586
https://labs.sra.io/posts/switchvox
https://sangomakb.atlassian.net/wiki/spaces/Switchvox/pages/1802371073/Switchvox+-+Release+Notes+Version+8.4.0.2+July+14+2026
https://github.com/advisories/GHSA-m32j-v93f-gfgc