Vulnerability · Published Jul 3, 2026 · Assigned by apache

CVE-2026-47897Apache Lucene.Net: Arbitrary file write from malicious server to Lucene.Net.Replicator client

High 8.9

In plain English

A high-severity path traversal in Apache Lucene.Net from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).

Severity (CVSS 4.0)8.9High

Exploit odds (30 days)0.7%top 45.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Lucene.Net (Lucene.Net.Replicator library). This issue affects Apache Lucene.Net.Replicator: from 4.8.0-beta00005 before 4.8.0-beta00018. Users are recommended to upgrade to version 4.8.0-beta00018, which fixes the issue.

Affected products (as reported)

Vendor	Product	Versions
Apache Software Foundation	Apache Lucene.Net	4.8.0-beta00005 – before 4.8.0-beta00018

Weakness: CWE-22 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/AU:Y/RE:L

In plain English

Official description

Affected products (as reported)

References