Paul Irwin

**Name of the Vulnerable Software and Affected Versions** Apache Lucene.Net.Replicator versions 4.8.0-beta00005 through 4.8.0-beta00017 **Description** A path traversal issue exists in the Lucene.Net.Replicator library due to improper input validation and sanitization of filesystem paths. This allows traversal sequences to escape the intended base path, potentially enabling unauthorized read or write access to files outside the replication directories. This can lead to the leakage of sensitive data, tampering with replicated index artifacts, or service compromise if an attacker can supply crafted path values to replication-related APIs or endpoints that pass user-controlled input into file operations. **Recommendations** Upgrade to version 4.8.0-beta00018.

**Name of the Vulnerable Software and Affected Versions** Apache Lucene.Net.Analysis.Common versions 4.8.0-beta00005 through 4.8.0-beta00017 **Description** Improper Restriction of XML External Entity Reference (XXE) in the Lucene.Net.Analysis.Common library, specifically within the PatternParser. XXE is a type of attack where an application processes XML input containing a reference to an external entity, potentially allowing an attacker to view files on the server or perform server-side request forgery. **Recommendations** Upgrade Apache Lucene.Net.Analysis.Common to version 4.8.0-beta00018.

**Name of the Vulnerable Software and Affected Versions** Apache Lucene.Net.Replicator versions 4.8.0-beta00005 through 4.8.0-beta00017 **Description** A Path Traversal issue exists in the Lucene.Net.Replicator library, which allows an unauthenticated user to perform an arbitrary file read on the replication server. Path Traversal is a flaw that allows an attacker to access files and directories that are stored outside the web root folder by manipulating variables that influence the path of a file or directory. **Recommendations** Upgrade to version 4.8.0-beta00018.

Name of the Vulnerable Software and Affected Versions: Apache Lucene versions 4.4.0 through 9.11.0 Description: The issue is related to the deserialization of untrusted data in the Apache Lucene Replicator. It affects the deprecated org.apache.lucene.replicator.http package, but not the org.apache.lucene.replicator.nrt package. The deserialization can only be triggered if users actively deploy a network-accessible implementation and a corresponding client using a HTTP library that uses the API. Recommendations: For versions 4.4.0 through 9.11.0, upgrade to version 9.12.0 to fix the issue. As a temporary workaround, consider using Java serialization filters, such as `-Djdk.serialFilter='!*'` on the command line, to mitigate the issue on vulnerable versions without impacting functionality.