CVE-2026-47896: Path Traversal in Apache Lucene.Net.Replicator (CVSS 7.5)

Technical summary

The Lucene.Net.Replicator library fails to properly validate and restrict file path inputs, enabling a classic directory traversal attack (CWE-22). An attacker can craft requests using path traversal sequences (such as ../ or absolute paths) to access files outside the designated replication directory. The vulnerability requires only network access and no authentication or user interaction, as indicated by the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N). While the attack does not permit file modification or system availability impact, the confidentiality impact is rated high, meaning sensitive application or system data may be exposed.

Business impact

Organizations using affected versions of Lucene.Net.Replicator risk unauthorized disclosure of confidential data stored on systems running the library. This could include indexed documents, configuration files, or other sensitive information accessible to the application process. The exposure is particularly concerning in multi-tenant or cloud environments where data isolation is critical. Compliance implications may arise if the exposed data includes regulated information (PII, PHI, financial records). The vulnerability requires prompt patching to prevent data exfiltration.

Affected systems

The Lucene.Net.Replicator component in Apache Lucene.Net versions 4.8.0-beta00005 through 4.8.0-beta00017 are vulnerable. Organizations should inventory dependencies on the Lucene.Net.Replicator library—commonly used for search index replication and synchronization in .NET applications. Beta versions indicate this affects pre-release software; however, if your organization has integrated beta releases into production or testing environments, you are at risk.

Exploitability

This vulnerability is readily exploitable. An attacker requires only network access to the vulnerable service and no credentials or user interaction. The low complexity (AC:L) of the attack means standard path traversal payloads should succeed, and exploitation can be automated. However, the vulnerability has not yet been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting active, widespread exploitation in the wild has not been publicly documented at this time. Organizations should not assume the absence of KEV listing means the vulnerability is unexploited; proactive patching remains essential.

Remediation

Upgrade Lucene.Net.Replicator to version 4.8.0-beta00018 or later immediately. If you cannot upgrade immediately, restrict network access to systems running the vulnerable library using firewall rules, network segmentation, or application-level access controls to limit exposure. Review audit logs and file access records for evidence of unauthorized path traversal attempts. After patching, conduct a limited data access review to determine if the vulnerability was exploited during the exposure window.

Patch guidance

Patch immediately to Lucene.Net.Replicator version 4.8.0-beta00018 or later. This is a beta-to-beta transition; verify the patch version against the official Apache Lucene.Net advisory before deployment. Test the patched version in a non-production environment to ensure compatibility with your indexing and replication workflows. Given the high confidentiality impact and ease of exploitation, treat this as a critical-priority update regardless of the beta maturity status.

Detection guidance

Monitor application and web server logs for HTTP requests or API calls containing path traversal sequences such as ../, ..\ , or encoded variants (%2e%2e%2f). Monitor file system access logs for unusual reads of files outside the expected replication directory. If your Lucene.Net.Replicator instance exposes a REST or HTTP interface, log all file requests and validate that accessed paths are within the intended directory. Implement intrusion detection rules to flag path traversal payloads targeting the replicator service.

Why prioritize this

This vulnerability merits immediate remediation. The CVSS score of 7.5 (HIGH) reflects a remotely exploitable, unauthenticated attack with high confidentiality impact. Although currently not listed in CISA's KEV catalog, the ease of exploitation and potential for sensitive data exposure make it a priority for any organization running affected versions. The availability of a patch in 4.8.0-beta00018 removes barriers to remediation.

Risk score, explained

The CVSS 3.1 score of 7.5 is driven by: (1) Network Attack Vector—any network-connected system running the vulnerable library is at risk; (2) Low Attack Complexity—standard path traversal techniques apply with no special conditions; (3) No Authentication Required—unauthenticated attackers can exploit this; (4) No User Interaction—the attack is fully automated; (5) High Confidentiality Impact—files outside the intended directory can be read; (6) No Integrity or Availability Impact—the vulnerability does not permit modification or denial of service. This score reflects a serious but non-critical risk suitable for rapid patching cycles.

Frequently asked questions