Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

Apache Lucene.Net can be tricked to write files

CVE-2026-47897 · published 4 months ago
Summary

If a Lucene.Net Replicator client connects to a malicious server, the server can cause the client to create or overwrite any file on the client’s system. This could let an attacker place unwanted programs or alter data. Update the Lucene.Net Replicator library to the latest version to stop this behavior.

What to do
  • Update apache software foundation apache lucene.net to version 4.8.0-beta00018 or later.
Affected software
VendorProductAffected versions
apache software foundation apache lucene.net < 4.8.0-beta00018
apache lucene.net 4.8.0
cpe:2.3:a:apache:lucene.net:4.8.0:beta00005:*:*:*:*:*:*
Original advisory text
Apache Lucene.Net: Arbitrary file write from malicious server to Lucene.Net.Replicator client
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Lucene.Net (Lucene.Net.Replicator library).

This issue affects Apache Lucene.Net.Replicator: from 4.8.0-beta00005 before 4.8.0-beta00018.

Users are recommended to upgrade to version 4.8.0-beta00018, which fixes the issue.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
7.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-22Path Traversal
Timeline
Published3 Jul 2026
Updated4 Nov 2026
First seen3 Jul 2026
Sources
CVE-2026-47897 · NVD
CVE-2026-47897 · MITRE
CVE-2026-47897 · OSV
Track software like this
Free during beta