Skip to main content

Apache Lucene.Net CVE-2026-47897

| EUVDEUVD-2026-41518 HIGH
Path Traversal (CWE-22)
2026-07-03 GHSA-6j76-xrvp-5rhc
Path Traversal Apache Lucene Net
8.9
CVSS 4.0 · Vendor
Share

Severity by source

Vendor (CNA) PRIMARY
8.9 HIGH
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:L/U:X
vuln.today AI
6.8 MEDIUM

Network-reachable, unauthenticated path traversal with real gating conditions (AC:H); file disclosure crosses the security boundary into other files (S:C, C:H) with no integrity or availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:L/U:X
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

6
Patch available
Jul 03, 2026 - 09:01 EUVD
Analysis Updated
Jul 03, 2026 - 08:28 vuln.today
v3 (cvss_changed)
Analysis Updated
Jul 03, 2026 - 08:28 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 03, 2026 - 08:22 vuln.today
cvss_changed
CVSS changed
Jul 03, 2026 - 08:22 NVD
8.9 (HIGH)
Analysis Generated
Jul 03, 2026 - 02:16 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Path traversal in the Apache Lucene.Net.Replicator library (versions 4.8.0-beta00005 through 4.8.0-beta00017) allows a remote, unauthenticated attacker to read files outside the intended index-replication directory by supplying crafted pathnames during index synchronization. The flaw is a CWE-22 restricted-directory bypass confined to file disclosure; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the vendor-supplied CVSS 4.0 base score of 8.9 reflects high confidentiality impact across a scope boundary. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Reach networked replication endpoint
Delivery
Send sync request with ../ traversal in filename
Exploit
Bypass index-directory restriction
Execution
Service reads out-of-scope file
Impact
Disclose file contents to attacker
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires network reachability to an application that uses the Lucene.Net.Replicator module for index replication (the vulnerable code path is only present when replication is deployed), and the affected version must be in the range 4.8.0-beta00005 through 4.8.0-beta00017. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The only quantitative signal provided is the vendor CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N, score 8.9), which indicates a network-reachable, unauthenticated flaw with high confidentiality impact on both the vulnerable and a subsequent system, but notably with high attack complexity (AC:H) and a present attack requirement (AT:P) - meaning successful exploitation depends on specific, non-guaranteed conditions rather than a simple always-works request. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker able to reach a Lucene.Net.Replicator service (or acting as a malicious replication peer) issues a synchronization request in which the requested index file name embeds directory-traversal sequences, causing the service to open and return a file outside the index directory such as a configuration file or credential store. Because the CVSS vector is AC:H/AT:P, the attacker likely must satisfy specific timing or state conditions during the replication exchange for the traversal to succeed. …
Remediation Upgrade the Lucene.Net.Replicator package to version 4.8.0-beta00018, the vendor-released patched version that fixes the path traversal, updating the NuGet/package reference in any application that depends on the Replicator module and redeploying. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

24 hours: Query application inventories and configuration management systems to identify any systems running Apache Lucene.Net.Replicator versions 4.8.0-beta00005 through 4.8.0-beta00017, including development and staging environments. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Lucene Net

View all
CVE-2026-47896 HIGH
8.9 Jul 03

Path traversal (CWE-22) in the Apache Lucene.Net.Replicator library lets remote attackers read files outside the intende
CVE-2024-43383 HIGH
8.1 Oct 31

Deserialization of Untrusted Data vulnerability in Apache Lucene.Net.Replicator.NET's Replicator library: from 4.8.0-bet
CVE-2026-47898 MEDIUM
4.0 Jul 03

XML External Entity injection in Apache Lucene.Net's PatternParser component (Lucene.Net.Analysis.Common library) allows

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0
CVE-2018-13379 CRITICAL POC
9.1
CVE-2015-0016 HIGH POC
7.8

Same technique Path Traversal

View all
CVE-2025-64446 CRITICAL POC
9.8
CVE-2015-0016 HIGH POC
7.8
CVE-2016-0752 HIGH POC
7.5
CVE-2024-13159 CRITICAL POC
9.8
CVE-2024-13160 CRITICAL POC
9.8
CVE-2024-13161 CRITICAL POC
9.8
CVE-2014-0780 CRITICAL POC
9.8
CVE-2024-48248 HIGH POC
8.6

Share

CVE-2026-47897 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy