CVE Explorer

CVE-2026-47896

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Lucene.Net (Lucene.Net.Replicator library). This issue affects Apache Lucene.Net.Replicator: from 4.8.0-beta00005 through 4.8.0-beta00017. Users are recommended to upgrade to version 4.8.0-beta00018, which fixes the issue.

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:f1cebf1a4b933e43528328119c4a6c2d99372f8fe8bd7f1c9f5f1c7d0c8ffef0

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Affected products and versions

1 source assertion

{"collectionURL":"https://www.nuget.org","defaultStatus":"unaffected","packageName":"Lucene.Net.Replicator","product":"Apache Lucene.Net","vendor":"Apache Software Foundation","versions":[{"lessThan":"4.8.0-beta00018","status":"affected","version":"4.8.0-beta00005","versionType":"semver"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:daa9cc34201d8263f0e498e1318d8311ddc3edd558e94d37dee087ba25fd0b12 · sha256:75d7984b42d55826… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"Automatable":"YES","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","baseScore":8.9,"baseSeverity":"HIGH","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/AU:Y/RE:L","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact"…

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:daa9cc34201d8263f0e498e1318d8311ddc3edd558e94d37dee087ba25fd0b12 · sha256:75d7984b42d55826… · /containers/cna/metrics/0/cvssV4_0

CWE assertions

1 source assertion

{"cweId":"CWE-22","description":"CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:daa9cc34201d8263f0e498e1318d8311ddc3edd558e94d37dee087ba25fd0b12 · sha256:75d7984b42d55826… · /containers/cna/problemTypes/0/descriptions/0

Source references

2 source assertions

{"url":"http://www.openwall.com/lists/oss-security/2026/07/03/1"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:daa9cc34201d8263f0e498e1318d8311ddc3edd558e94d37dee087ba25fd0b12 · sha256:75d7984b42d55826… · /containers/adp/0/references/0

{"tags":["vendor-advisory"],"url":"https://lists.apache.org/thread/7y9gbt17p55fh1zltks4pnh719wq9sqt"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:daa9cc34201d8263f0e498e1318d8311ddc3edd558e94d37dee087ba25fd0b12 · sha256:75d7984b42d55826… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer