Executive brief
A security vulnerability exists in the Apache Lucene.Net.Replicator library, which is used to synchronize search index data between different servers. An attacker could exploit this flaw to access sensitive files on the server that should normally be restricted. This could lead to the exposure of confidential configuration files or system data, potentially compromising the entire search infrastructure.
Technical details
A path traversal vulnerability (CWE-22) exists in the Apache Lucene.Net.Replicator library. The flaw stems from improper limitation of pathnames when handling replication requests, allowing an attacker to navigate outside of the intended directory scope. This is a network-reachable vulnerability that does not require authentication or user interaction. Successful exploitation allows an attacker to read sensitive files from the underlying file system. The issue is fixed in version 4.8.0-beta00018.
Affected products
- Apache Software Foundation Lucene.Net.Replicator 4.8.0-beta00005 through 4.8.0-beta00017
Timeline
- 2026-07-03: advisory: NVD publication date
- 2026-07-03: patched: Version 4.8.0-beta00018 released to address the issue