Which versions of Apache Lucene.Net are affected by CVE-2026-47896?

A path traversal vulnerability in Apache Lucene.Net.Replicator library versions 4.8.0-beta00005 through 4.8.0-beta00017 allows unauthenticated remote attackers to read arbitrary files from affected…. A patch is available.

How to fix or mitigate CVE-2026-47896?

Within 24 hours: Identify all systems and applications running Apache Lucene.Net.Replicator versions 4.8.0-beta00005 through 4.8.0-beta00017. Within 7 days: Upgrade all affected instances to Apache Lucene.Net.Replicator version 4.8.0-beta00018 or later. Within 30 days: Review server access logs for exploitation attempts and assess whether sensitive files were accessed.

Apache Lucene.Net CVE-2026-47896

Q: What is the CVSS score of CVE-2026-47896?

CVE-2026-47896 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:L/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-41519 HIGH

Path Traversal (CWE-22)

2026-07-03

GHSA-mggp-f2j5-mm3g

Path Traversal Apache Lucene Net

8.9

CVSS 4.0 · Vendor

Severity by source

Vendor (CNA) PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:L/U:X

vuln.today AI

8.6 MEDIUM

Unauthenticated network read (PR:N/AV:N/AC:L) disclosing files outside the index directory gives S:C and C:H, with no integrity or availability impact (I:N/A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 03, 2026 - 10:01 EUVD

Analysis Updated

Jul 03, 2026 - 09:28 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 03, 2026 - 09:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 03, 2026 - 09:22 vuln.today

cvss_changed

CVSS changed

Jul 03, 2026 - 09:22 NVD

8.9 (HIGH)

Analysis Generated

Jul 03, 2026 - 02:16 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Path traversal (CWE-22) in the Apache Lucene.Net.Replicator library lets remote attackers read files outside the intended index directory by supplying crafted pathnames to the replication service, disclosing arbitrary server-side files. All releases from 4.8.0-beta00005 through 4.8.0-beta00017 are affected, and Apache fixed it in 4.8.0-beta00018. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the CVSS 4.0 base score of 8.9 (High) reflects unauthenticated network access and high confidentiality impact including a subsequent-system scope change.

Technical ContextAI

Lucene.Net is the .NET/C

port of the Apache Lucene search library, and Lucene.Net.Replicator is the sub-component that synchronizes Lucene index files (segments) between a primary node and replica nodes, typically exposing an HTTP replication endpoint (ReplicationService) that serves the individual files that make up an index revision. The root cause is CWE-22, Improper Limitation of a Pathname to a Restricted Directory: the service resolves a client-supplied file/session identifier into a filesystem path without adequately constraining it to the index directory, so sequences such as '../' allow escaping the intended base directory. Because replication is designed to hand raw index files to a requesting client over the network, an inadequately validated pathname turns the file-serving handler into an arbitrary file read primitive against the host running the replicator.

RemediationAI

Vendor-released patch: upgrade the Lucene.Net.Replicator package to 4.8.0-beta00018, which fixes the path traversal, as recommended in the Apache advisory (https://seclists.org/oss-sec/2026/q3/13 and https://lucenenet.apache.org/). Where an immediate upgrade is not possible, restrict network access to the replication endpoint so it is reachable only from trusted replica nodes - for example bind the ReplicationService to a private interface or place it behind an authenticating reverse proxy and firewall the port from untrusted networks - accepting the trade-off that replicas outside that boundary will stop syncing; if the replication feature is not actually needed, disable or remove the Replicator service entirely to eliminate the exposed handler. Because the flaw is read-only path traversal, running the search/replicator process under a least-privilege account limits which files an attacker can disclose, though it does not close the vulnerability.