Junglewise Threat Intelligence

CVE-2026-47896: Apache Lucene.Net path traversal in Lucene.Net.Replicator

CVE-2026-47896 · Severity: info · CVSS 8.9 · Published 2026-07-03

Vendors: Apache Software Foundation.

Executive brief

A security vulnerability exists in the Apache Lucene.Net.Replicator library, which is used to synchronize search index data between different servers. An attacker could exploit this flaw to access sensitive files on the server that should normally be restricted. This could lead to the exposure of confidential configuration files or system data, potentially compromising the entire search infrastructure.

Technical details

A path traversal vulnerability (CWE-22) exists in the Apache Lucene.Net.Replicator library. The flaw stems from improper limitation of pathnames when handling replication requests, allowing an attacker to navigate outside of the intended directory scope. This is a network-reachable vulnerability that does not require authentication or user interaction. Successful exploitation allows an attacker to read sensitive files from the underlying file system. The issue is fixed in version 4.8.0-beta00018.

Affected products

  • Apache Software Foundation Lucene.Net.Replicator 4.8.0-beta00005 through 4.8.0-beta00017

Timeline

  • 2026-07-03: advisory: NVD publication date
  • 2026-07-03: patched: Version 4.8.0-beta00018 released to address the issue

References

Related threats