CVE-2026-47896

Published: Jul 3, 2026Modified: Jul 8, 2026

8.9

Vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:L/U:X

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:L/U:XShow less

Source: security@apache.org (Secondary)

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Lucene.Net (Lucene.Net.Replicator library). This issue affects Apache Lucene.Net.Replicator: from 4.8.0-beta00005 through 4.8.0-beta00017. Users are recommended to upgrade to version 4.8.0-beta00018, which fixes the issue.

Affected (13)

Products: Apache: Lucene.net

Apache

1 product

Lucene.net

Configuration A

13 vulnerable

Vulnerable Software	Affected Versions
Apache Lucene.net	Version 4.8.0 beta00005
Apache Lucene.net	Version 4.8.0 beta00006
Apache Lucene.net	Version 4.8.0 beta00007
Apache Lucene.net	Version 4.8.0 beta00008
Apache Lucene.net	Version 4.8.0 beta00009
Apache Lucene.net	Version 4.8.0 beta00010
Apache Lucene.net	Version 4.8.0 beta00011
Apache Lucene.net	Version 4.8.0 beta00012
Apache Lucene.net	Version 4.8.0 beta00013
Apache Lucene.net	Version 4.8.0 beta00014
Apache Lucene.net	Version 4.8.0 beta00015
Apache Lucene.net	Version 4.8.0 beta00016
Apache Lucene.net	Version 4.8.0 beta00017

Related CWEs

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (2)

https://lists.apache.org/thread/7y9gbt17p55fh1zltks4pnh719wq9sqt

Source: security@apache.org

Mailing ListVendor Advisory

http://www.openwall.com/lists/oss-security/2026/07/03/1

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

Timeline

No history available yet.