CVE-2026-47897: Apache Lucene.NET Path Traversal Flaw

CVE-2026-47897 Overview

CVE-2026-47897 is a path traversal vulnerability [CWE-22] affecting the Apache Lucene.Net.Replicator library. The flaw allows remote attackers to write files outside the intended directory through improper validation of pathnames supplied to the replication component. Affected versions range from 4.8.0-beta00005 through 4.8.0-beta00017, with the fix landing in 4.8.0-beta00018. The Apache Software Foundation published the advisory through its security mailing list and recommends immediate upgrade for all deployments using the Replicator module.

Critical Impact
Remote unauthenticated attackers can traverse directory boundaries to write files outside the intended replication path, enabling potential integrity compromise across systems consuming the replicated index data.

Affected Products

Apache Lucene.Net.Replicator 4.8.0-beta00005 through 4.8.0-beta00017
Any .NET application embedding the vulnerable Replicator library
Search and indexing services using Lucene.Net replication over the network

Discovery Timeline

2026-07-03 - CVE-2026-47897 published to NVD
2026-07-03 - Apache Software Foundation publishes advisory via project mailing list
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-47897

Vulnerability Analysis

The vulnerability resides in the Lucene.Net.Replicator library, which coordinates index replication between a primary node and one or more replicas. The Replicator transfers index files from a source to a destination and writes them to a local directory on the receiving node. When incoming file names are not properly sanitized, an attacker controlling the source or acting as a man-in-the-middle can inject relative path segments to escape the destination directory. This allows the writing of arbitrary files at attacker-chosen locations on the replica host, subject to the process permissions of the Lucene.Net service.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The Replicator does not sufficiently normalize or validate the file name components received during replication before concatenating them to the target directory path. Sequences such as ..\ or absolute path prefixes are treated as legitimate names, so the resolved destination escapes the intended index storage location. The flaw is a design-level input validation gap in the file transfer routine rather than a memory safety issue.

Attack Vector

Exploitation requires an attacker to influence the file names delivered to a Replicator client. This can occur when a client pulls an index revision from a malicious or compromised Replicator source over the network. No authentication is required against the vulnerable client. A successful attack writes files outside the replication directory, which can overwrite configuration, drop executables into startup paths, or corrupt neighboring application data. The technical details are described in the Apache advisory referenced below.

See the Apache Mailing List Discussion and the OpenWall OSS Security Update for the vendor description.

Detection Methods for CVE-2026-47897

Indicators of Compromise

Files appearing in system directories outside the configured Lucene.Net replication path with recent write timestamps matching replication activity.
Replicator client log entries showing file names containing .., backslash sequences, or absolute paths during index revision downloads.
Unexpected outbound connections from application servers to untrusted Replicator source endpoints.
Modifications to .config, startup scripts, or scheduled task files on hosts running Lucene.Net workloads.

Detection Strategies

Inventory all .NET applications and identify those referencing Lucene.Net.Replicator assemblies between versions 4.8.0-beta00005 and 4.8.0-beta00017.
Enable file integrity monitoring on directories adjacent to the Lucene.Net index storage location to detect writes outside the expected path.
Instrument replication clients to log the full resolved destination path for every received file and alert on paths outside the configured root.
Review network flow logs for Replicator traffic to sources outside the trusted replication topology.

Monitoring Recommendations

Correlate Lucene.Net process file writes with the configured index directory using endpoint telemetry.
Alert on child process creation from Lucene.Net service accounts, which may indicate a written payload was executed.
Track application version deployment through software asset management to confirm remediation across all replicas.

How to Mitigate CVE-2026-47897

Immediate Actions Required

Upgrade all instances of Lucene.Net.Replicator to version 4.8.0-beta00018 or later, which contains the vendor fix.
Restrict network access to Replicator endpoints so clients only accept revisions from trusted source hosts.
Run Lucene.Net service processes under a least-privilege account with write access limited to the index directory.
Audit hosts that previously ran vulnerable versions for anomalous files written outside the replication directory.

Patch Information

The Apache Lucene.Net project released 4.8.0-beta00018 to address CVE-2026-47897. The fix adds pathname validation in the Replicator file transfer logic to reject names that resolve outside the configured destination directory. Upgrade instructions and the corresponding NuGet package are referenced in the Apache Mailing List Discussion.

Workarounds

If upgrading is not immediately feasible, disable the Replicator component and rely on out-of-band index synchronization until the patch can be applied.
Terminate TLS at a reverse proxy that validates Replicator source identity and enforces mutual authentication.
Apply operating system access control lists that prevent the Lucene.Net service account from writing outside the index directory tree.

bash

# Update the Lucene.Net.Replicator NuGet package to the fixed version
dotnet add package Lucene.Net.Replicator --version 4.8.0-beta00018

# Verify installed package version across the solution
dotnet list package | grep -i Lucene.Net.Replicator