Read the docs
TI-2026-35345 Aliases CVE-2026-47897GHSA-6j76-xrvp-5rhc

Apache Lucene.Net: Arbitrary file write from malicious server to Lucene.Net.Replicator client

Priority MEDIUM 40CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Lucene.Net (Lucene.Net.Replicator library). This issue affects Apache Lucene.Net.Replicator: from 4.8.0-beta00005 before 4.8.0-beta00018. Users are recommended to upgrade to version 4.8.0-beta00018, which fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00721 54th percentileScored 2026-11-07
Fix Fixed Apache Lucene.Net (Apache Software Foundation): 4.8.0-beta00018

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Lucene.Net4.8.0-beta00005 to before 4.8.0-beta000184.8.0-beta00018Patch availableCNA
  • Apache Lucene.Net VendorApache Affected 4.8.0-beta00005 to before 4.8.0-beta00018 Fixed in 4.8.0-beta00018 Patch available CNA

CPE configurations NVD · 13

CPEVersionsRoleVendor
cpe:2.3:a:apache:lucene.net:4.8.0:beta00005:*:*:*:*:*:*4.8.0 beta00005VulnerableApache
cpe:2.3:a:apache:lucene.net:4.8.0:beta00006:*:*:*:*:*:*4.8.0 beta00006VulnerableApache
cpe:2.3:a:apache:lucene.net:4.8.0:beta00007:*:*:*:*:*:*4.8.0 beta00007VulnerableApache
cpe:2.3:a:apache:lucene.net:4.8.0:beta00008:*:*:*:*:*:*4.8.0 beta00008VulnerableApache
cpe:2.3:a:apache:lucene.net:4.8.0:beta00009:*:*:*:*:*:*4.8.0 beta00009VulnerableApache
cpe:2.3:a:apache:lucene.net:4.8.0:beta00010:*:*:*:*:*:*4.8.0 beta00010VulnerableApache
cpe:2.3:a:apache:lucene.net:4.8.0:beta00011:*:*:*:*:*:*4.8.0 beta00011VulnerableApache
cpe:2.3:a:apache:lucene.net:4.8.0:beta00012:*:*:*:*:*:*4.8.0 beta00012VulnerableApache
cpe:2.3:a:apache:lucene.net:4.8.0:beta00013:*:*:*:*:*:*4.8.0 beta00013VulnerableApache
cpe:2.3:a:apache:lucene.net:4.8.0:beta00014:*:*:*:*:*:*4.8.0 beta00014VulnerableApache
  • cpe:2.3:a:apache:lucene.net:4.8.0:beta00005:*:*:*:*:*:* Versions 4.8.0 beta00005 Vulnerable ·Apache
  • cpe:2.3:a:apache:lucene.net:4.8.0:beta00006:*:*:*:*:*:* Versions 4.8.0 beta00006 Vulnerable ·Apache
  • cpe:2.3:a:apache:lucene.net:4.8.0:beta00007:*:*:*:*:*:* Versions 4.8.0 beta00007 Vulnerable ·Apache
  • cpe:2.3:a:apache:lucene.net:4.8.0:beta00008:*:*:*:*:*:* Versions 4.8.0 beta00008 Vulnerable ·Apache
  • cpe:2.3:a:apache:lucene.net:4.8.0:beta00009:*:*:*:*:*:* Versions 4.8.0 beta00009 Vulnerable ·Apache
  • cpe:2.3:a:apache:lucene.net:4.8.0:beta00010:*:*:*:*:*:* Versions 4.8.0 beta00010 Vulnerable ·Apache
  • cpe:2.3:a:apache:lucene.net:4.8.0:beta00011:*:*:*:*:*:* Versions 4.8.0 beta00011 Vulnerable ·Apache
  • cpe:2.3:a:apache:lucene.net:4.8.0:beta00012:*:*:*:*:*:* Versions 4.8.0 beta00012 Vulnerable ·Apache
  • cpe:2.3:a:apache:lucene.net:4.8.0:beta00013:*:*:*:*:*:* Versions 4.8.0 beta00013 Vulnerable ·Apache
  • cpe:2.3:a:apache:lucene.net:4.8.0:beta00014:*:*:*:*:*:* Versions 4.8.0 beta00014 Vulnerable ·Apache
Show 3 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:apache:lucene.net:4.8.0:beta00015:*:*:*:*:*:*4.8.0 beta00015VulnerableApache
cpe:2.3:a:apache:lucene.net:4.8.0:beta00016:*:*:*:*:*:*4.8.0 beta00016VulnerableApache
cpe:2.3:a:apache:lucene.net:4.8.0:beta00017:*:*:*:*:*:*4.8.0 beta00017VulnerableApache
  • cpe:2.3:a:apache:lucene.net:4.8.0:beta00015:*:*:*:*:*:* Versions 4.8.0 beta00015 Vulnerable ·Apache
  • cpe:2.3:a:apache:lucene.net:4.8.0:beta00016:*:*:*:*:*:* Versions 4.8.0 beta00016 Vulnerable ·Apache
  • cpe:2.3:a:apache:lucene.net:4.8.0:beta00017:*:*:*:*:*:* Versions 4.8.0 beta00017 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Lucene.Net (Apache Software Foundation) Fixed in 4.8.0-beta00018

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Apache Lucene.Net 4.8.0-beta00018

    3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-35344 Apache Lucene.Net: Unauthenticated arbitrary file read on the Lucene.Net.Replicator replication serverPriority MEDIUM 40
    • TI-2026-35346 Apache Lucene.Net: XXE vulnerability in Lucene.Net.Analysis.Common PatternParserPriority LOW 19
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-47897
  2. 2026-10-03 Alias added: GHSA-6j76-xrvp-5rhc

References

Advisory 2

  • TI-2026-35344 Apache Lucene.Net: Unauthenticated arbitrary file read on the Lucene.Net.Replicator replication server CVSS 4.0HIGH 8.9
  • TI-2024-29032 Apache Lucene.Net.Replicator: Remote Code Execution in Lucene.Net.Replicator CVSS 3.1HIGH 8.1
  • TI-2026-35346 Apache Lucene.Net: XXE vulnerability in Lucene.Net.Analysis.Common PatternParser CVSS 4.0MEDIUM 4.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences