An authenticated local file inclusion vulnerability (CWE-73) exists in Sangoma Switchvox SMB Edition 8.3 (104997) due to insufficient validation of the sound_path parameter in the play_file functionality. This flaw allows an authenticated attacker to specify absolute file paths, enabling unauthorized reading of files outside the intended directory scope on the underlying filesystem. The vulnerability has a CVSS 4.0 base score of 7.1, indicating high severity. No vendor advisory or patch information is currently available, and the product is not a cloud service.

An authenticated attacker with local access can exploit this vulnerability to read arbitrary files on the system by supplying absolute paths through the vulnerable parameter. This may lead to unauthorized disclosure of sensitive information stored outside the intended directory scope. There is no indication of remote exploitation without authentication or privilege escalation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict authenticated user access to trusted users only and monitor for suspicious activity related to file access. Avoid exposing the vulnerable functionality to untrusted users.