Apache Lucene.Net.Analysis.Common contains an improper restriction of XML External Entity references (CWE‑611), a form of XXE. The flaw can be triggered by supplying XML that declares external entities, which, if the parser resolves them, may expose internal files or other system resources. The CVE description does not explicitly state that the attacker can read arbitrary files, but this is a common consequence of XXE vulnerabilities.

Apache Lucene.Net.Analysis.Common library from 4.8.0‑beta00005 up to (but not including) 4.8.0‑beta00018, distributed by the Apache Software Foundation, is affected. Applications that integrate these beta releases for text indexing, search, or data processing could be impacted if they feed untrusted XML to the Parser.

The CVSS base score of 4.0 indicates a low risk level, and the EPSS score of <1% suggests a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to supply a crafted XML document to an application that processes XML via the affected library. If external entity resolution is enabled, the attacker could read confidential data; otherwise the risk is mitigated.