CVE-2026-47897Disclosure(apache / lucene.net)

Apache Lucene.⁠Net CVE-2026-47896: Unauthenticated arbitrary file read on the Replicator replication server https://www.openwall.com/lists/oss-security/2026/07/03/1 CVE-2026-47897: Arbitrary file write from malicious server to Replicator client https://www.openwall.com/lists/oss-security/2026/07/03/2 CVE-2026-47898: XXE https://www.openwall.com/lists/oss-security/2026/07/03/3

🚨 HIGH - Path Traversal in http://Lucene.Net Replicator (CVE-2026-47897) A path traversal vulnerability was discovered in the Apache http://Lucene.Net Replicator library (http://Lucene.Net.Replicator) that can allow file access outside the intended replication directories. The root cause is improper input validation/sanitization of filesystem paths, enabling traversal sequences to escape the expected base path. An attacker can exploit this by supplying crafted path values to replication-related APIs or endpoints that pass user-controlled input into file operations, typically requiring access to a service exposing the replicator functionality or the ability to influence replication requests/config. If exploited, the impact can include unauthorized read/write of files, leakage of sensitive data, tampering with replicated index artifacts, and potential service compromise depending on what files are reachable. 👉 Affected: http://Lucene.Net.Replicator 4.8.0-beta00005 to 4.8.0-beta00017 | Upgrade to 4.8.0-beta00018