CVE-2026-47897: Path Traversal in Apache Lucene.Net Replicator

Technical summary

CVE-2026-47897 is a path traversal vulnerability (CWE-22) in the Lucene.Net.Replicator library stemming from improper validation of file path inputs. The flaw permits attackers to traverse the filesystem using relative path sequences (such as '../' constructs) to write files outside the intended restricted directory. The CVSS 3.1 score of 7.5 (HIGH) reflects high integrity impact with network accessibility, no authentication requirement, and low attack complexity. The vulnerability affects all beta releases from 4.8.0-beta00005 through 4.8.0-beta00017 and is remediated in 4.8.0-beta00018.

Business impact

Organizations using vulnerable versions of Lucene.Net.Replicator face risk of unauthorized file modification on systems hosting the library. This can lead to application compromise, data corruption, or deployment of malicious code without requiring user interaction or authentication. In production search indexing and document replication scenarios, successful exploitation could compromise data integrity, trigger application failures, or enable lateral movement within infrastructure. The severity is heightened for systems exposed to untrusted networks or used in multi-tenant environments.

Affected systems

Apache Lucene.Net.Replicator versions 4.8.0-beta00005 through 4.8.0-beta00017 are vulnerable. This includes all intermediate beta releases within that range. Users running 4.8.0-beta00018 or later are not affected. Organizations should audit their dependencies to identify Lucene.Net usage; the Replicator library is commonly used for distributed search index replication and synchronization.

Exploitability

The vulnerability is readily exploitable. No authentication is required, attack complexity is low, and exploitation can occur over the network. An attacker can send specially crafted requests to the Replicator service containing path traversal sequences to write arbitrary files. While not yet listed in the CISA Known Exploited Vulnerabilities catalog, the straightforward nature of path traversal attacks and the network-accessible nature of Replicator services make this a practical threat. The attack requires only network access to an affected Lucene.Net service.

Remediation

Upgrade Lucene.Net.Replicator to version 4.8.0-beta00018 or later. This version includes fixes that properly validate and constrain file paths, preventing traversal outside intended directories. Organizations must verify this patch version against the official Apache Lucene.Net advisory to confirm applicability. If immediate patching is not possible, restrict network access to Lucene.Net Replicator services using firewall rules or network segmentation to limit exposure to trusted systems only.

Patch guidance

Verify your current Lucene.Net.Replicator version in your project dependencies. For NuGet-based projects, check project files or package managers. Upgrade to 4.8.0-beta00018 by updating the NuGet package reference and rebuilding your application. Test the patched version in a staging environment to confirm compatibility with your search indexing and replication workflows. Given the beta status of affected versions, prioritize this update and consider your roadmap for moving to stable release versions of Lucene.Net.

Detection guidance

Monitor Lucene.Net Replicator service logs for file write requests containing path traversal patterns (consecutive ../ sequences, absolute paths, or unusual directory references). Implement file integrity monitoring on directories where Lucene.Net writes index replicas and configuration files to detect unauthorized modifications. Network-level detection can focus on HTTP/HTTPS requests to Replicator endpoints containing encoded path traversal sequences (%2e%2e, %252f, etc.). Compare running application versions against known vulnerable ranges using dependency scanning tools in your build pipeline.

Why prioritize this

This vulnerability merits immediate attention due to its HIGH CVSS score, network accessibility, lack of authentication requirement, and potential for unauthorized file modification. While not yet exploited in the wild (per KEV status), path traversal flaws are well-understood and trivial to weaponize. Any Lucene.Net deployment exposed to untrusted networks should be patched urgently. The impact on data integrity and potential for privilege escalation through file modification elevates risk in production environments.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects an attack that is network-accessible (AV:N), requires no special conditions to exploit (AC:L), needs no user privileges (PR:N), and involves no user interaction (UI:N). The vulnerability causes high integrity impact (I:H) by allowing file modification, though it does not directly compromise confidentiality (C:N) or availability (A:N). The score appropriately captures the practical threat of remote, unauthenticated file tampering.

Frequently asked questions