Which versions of Apache Lucene.Net are affected by CVE-2026-47897?

Apache Lucene.Net.Replicator versions 4.8.0-beta contain a path traversal vulnerability allowing unauthenticated remote file disclosure from search index systems, potentially exposing sensitive data…. A patch is available.

How to fix or mitigate CVE-2026-47897?

24 hours: Query application inventories and configuration management systems to identify any systems running Apache Lucene.Net.Replicator versions 4.8.0-beta00005 through 4.8.0-beta00017, including development and staging environments. 7 days: For confirmed installations, implement network-level access restrictions on replication endpoints; document the risk and assign ownership for remediation tracking. 30 days: Monitor Apache/Lucene vendor advisories for patch availability and develop an upgrade plan to a patched or non-beta release; conduct testing in staging environments to validate compatibility.

Apache Lucene.Net CVE-2026-47897

Q: What is the CVSS score of CVE-2026-47897?

CVE-2026-47897 has a CVSS 4.0 base score of 8.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:L/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-41518 HIGH

Path Traversal (CWE-22)

2026-07-03

GHSA-6j76-xrvp-5rhc

Apache Path Traversal Lucene Net

8.9

CVSS 4.0 · Vendor

Severity by source

Vendor (CNA) PRIMARY

8.9 HIGH

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:L/U:X

vuln.today AI

6.8 MEDIUM

Network-reachable, unauthenticated path traversal with real gating conditions (AC:H); file disclosure crosses the security boundary into other files (S:C, C:H) with no integrity or availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 03, 2026 - 09:01 EUVD

Analysis Updated

Jul 03, 2026 - 08:28 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 03, 2026 - 08:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 03, 2026 - 08:22 vuln.today

cvss_changed

CVSS changed

Jul 03, 2026 - 08:22 NVD

8.9 (HIGH)

Analysis Generated

Jul 03, 2026 - 02:16 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Path traversal in the Apache Lucene.Net.Replicator library (versions 4.8.0-beta00005 through 4.8.0-beta00017) allows a remote, unauthenticated attacker to read files outside the intended index-replication directory by supplying crafted pathnames during index synchronization. The flaw is a CWE-22 restricted-directory bypass confined to file disclosure; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the vendor-supplied CVSS 4.0 base score of 8.9 reflects high confidentiality impact across a scope boundary. Exploitation is gated by high attack complexity and specific attack requirements, making practical abuse less trivial than the raw score suggests.

Technical ContextAI

Lucene.Net is the .NET port of the Apache Lucene search engine, and the Replicator module implements index replication so a client node can pull index files (segments) from a master node over a network channel, typically an HTTP-based replication service. The vulnerability is CWE-22, Improper Limitation of a Pathname to a Restricted Directory: the file names transmitted or requested during replication are not properly canonicalized or constrained to the designated index directory, so sequences such as '../' allow references to escape into arbitrary filesystem locations. Because replication legitimately transfers files by name, an attacker who can influence the requested filenames (or a malicious peer in the replication exchange) can coerce the process into reading files it should not, disclosing their contents to the requesting party.

RemediationAI

Upgrade the Lucene.Net.Replicator package to version 4.8.0-beta00018, the vendor-released patched version that fixes the path traversal, updating the NuGet/package reference in any application that depends on the Replicator module and redeploying. If immediate upgrade is not possible, restrict network exposure of the replication endpoint so only trusted master/replica nodes can reach it - for example, place the replication service behind network ACLs or a mutually authenticated channel and block untrusted clients - accepting the trade-off that this only reduces exposure and does not fix the underlying filename handling. Additionally, run the replication service under a least-privilege account whose filesystem read scope is confined to the index directory, limiting what a traversal could disclose. Consult the Apache advisory thread at https://lists.apache.org/thread/on1j3zmvgtf8n9fw78z3lyf6dn94p5zc and the oss-security post at https://seclists.org/oss-sec/2026/q3/14 for authoritative details.