Skip to main content

Apache Lucene.Net CVE-2026-47896

| EUVDEUVD-2026-41519 HIGH
Path Traversal (CWE-22)
2026-07-03 GHSA-mggp-f2j5-mm3g
Path Traversal Apache Lucene Net
8.9
CVSS 4.0 · Vendor
Share

Severity by source

Vendor (CNA) PRIMARY
8.9 HIGH
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:L/U:X
vuln.today AI
8.6 MEDIUM

Unauthenticated network read (PR:N/AV:N/AC:L) disclosing files outside the index directory gives S:C and C:H, with no integrity or availability impact (I:N/A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:L/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

6
Patch available
Jul 03, 2026 - 10:01 EUVD
Analysis Updated
Jul 03, 2026 - 09:28 vuln.today
v3 (cvss_changed)
Analysis Updated
Jul 03, 2026 - 09:28 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 03, 2026 - 09:22 vuln.today
cvss_changed
CVSS changed
Jul 03, 2026 - 09:22 NVD
8.9 (HIGH)
Analysis Generated
Jul 03, 2026 - 02:16 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Path traversal (CWE-22) in the Apache Lucene.Net.Replicator library lets remote attackers read files outside the intended index directory by supplying crafted pathnames to the replication service, disclosing arbitrary server-side files. All releases from 4.8.0-beta00005 through 4.8.0-beta00017 are affected, and Apache fixed it in 4.8.0-beta00018. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Locate exposed Lucene.Net replication endpoint
Delivery
Send request with '../' traversal in file path
Exploit
Service resolves path outside index dir
Execution
Read arbitrary server files
Impact
Exfiltrate secrets/configuration
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the target application deploys and network-exposes the Lucene.Net.Replicator server component (the HTTP ReplicationService that serves index files) on an affected version (4.8.0-beta00005 through 4.8.0-beta00017) - this is the AT:P attack requirement and the primary limiting factor, since embedded Lucene.Net search without the replicator is not exploitable. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N, score 8.9 High) indicates a network-reachable, low-complexity, unauthenticated read-only disclosure with a subsequent-system confidentiality impact (SC:H) and no integrity or availability impact - consistent with arbitrary file read rather than code execution. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who can reach the Lucene.Net replication HTTP endpoint sends a crafted request whose file or session identifier contains directory-traversal sequences (e.g. '../../') to escape the index directory and retrieve arbitrary files such as configuration files, credentials, or connection strings on the server. …
Remediation Vendor-released patch: upgrade the Lucene.Net.Replicator package to 4.8.0-beta00018, which fixes the path traversal, as recommended in the Apache advisory (https://seclists.org/oss-sec/2026/q3/13 and https://lucenenet.apache.org/). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Identify all systems and applications running Apache Lucene.Net.Replicator versions 4.8.0-beta00005 through 4.8.0-beta00017. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Lucene Net

View all
CVE-2026-47897 HIGH
8.9 Jul 03

Path traversal in the Apache Lucene.Net.Replicator library (versions 4.8.0-beta00005 through 4.8.0-beta00017) allows a r
CVE-2024-43383 HIGH
8.1 Oct 31

Deserialization of Untrusted Data vulnerability in Apache Lucene.Net.Replicator.NET's Replicator library: from 4.8.0-bet
CVE-2026-47898 MEDIUM
4.0 Jul 03

XML External Entity injection in Apache Lucene.Net's PatternParser component (Lucene.Net.Analysis.Common library) allows

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0
CVE-2018-13379 CRITICAL POC
9.1
CVE-2015-0016 HIGH POC
7.8

Same technique Path Traversal

View all
CVE-2025-64446 CRITICAL POC
9.8
CVE-2015-0016 HIGH POC
7.8
CVE-2016-0752 HIGH POC
7.5
CVE-2024-13159 CRITICAL POC
9.8
CVE-2024-13160 CRITICAL POC
9.8
CVE-2024-13161 CRITICAL POC
9.8
CVE-2014-0780 CRITICAL POC
9.8
CVE-2024-48248 HIGH POC
8.6

Share

CVE-2026-47896 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy