An authenticated user with access to the Switchvox SMB Web Portal can exploit the play_file function, which accepts a sound_path parameter that is not properly validated. The flaw allows the attacker to supply arbitrary absolute paths and read any file that the portal’s process can access. This results in unauthorized disclosure of configuration files, credentials, or other sensitive data stored outside the intended directory, thereby compromising data confidentiality and system integrity.

The vulnerability affects Sangoma Switchvox SMB Edition version 8.3 (revision 104997) when the SMB Web Portal is present. Only installations running this specific build and providing authenticated access to the portal are vulnerable.

The CVSS score of 7.1 indicates a medium-to-high severity, while the EPSS score of less than 1% suggests a low probability of active exploitation. The issue is not listed in the CISA KEV catalog. Because the flaw requires authentication, an attacker must first have valid credentials before constructing a request with an absolute path. Once inside, the file reads can be elicited and the contents returned through the portal interface. The weakness is a local file inclusion vulnerability (CWE-73), which can be leveraged by an attacker to exfiltrate sensitive files that lie outside the intended directory scope.