Vulnerability · Published Jul 3, 2026 · Assigned by apache

CVE-2026-47896Apache Lucene.Net: Unauthenticated arbitrary file read on the Lucene.Net.Replicator replication server

High 8.9

In plain English

A high-severity path traversal in Apache Lucene.Net from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities).

Severity (CVSS 4.0)8.9High

Exploit odds (30 days)0.8%top 43.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Lucene.Net (Lucene.Net.Replicator library). This issue affects Apache Lucene.Net.Replicator: from 4.8.0-beta00005 through 4.8.0-beta00017. Users are recommended to upgrade to version 4.8.0-beta00018, which fixes the issue.

Affected products (as reported)

Vendor	Product	Versions
Apache Software Foundation	Apache Lucene.Net	4.8.0-beta00005 – before 4.8.0-beta00018

Weakness: CWE-22 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/AU:Y/RE:L

In plain English

Official description

Affected products (as reported)

References