Log in Start free

Vulnerability · Published Dec 9, 2025 · Assigned by GovTech CSG

CVE-2025-14306Directory Traversal in Robocode's CacheCleaner Component

Critical 10.0

In plain English

A critical-severity path traversal in Robocode from Robocode Project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)10.0Critical
Exploit odds (30 days)1.1%top 35.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A directory traversal vulnerability exists in the CacheCleaner component of Robocode version 1.9.3.6. The recursivelyDelete method fails to properly sanitize file paths, allowing attackers to traverse directories and delete arbitrary files on the system. This vulnerability can be exploited by submitting specially crafted inputs that manipulate the file path, leading to potential unauthorized file deletions. https://robo-code.blogspot.com/

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12robocodeno fix listedDEBIAN-CVE-2025-14306
Debian:13robocodeno fix listedDEBIAN-CVE-2025-14306
Debian:14robocodeno fix listedDEBIAN-CVE-2025-14306
Mavennet.sf.robocode:robocode.core1.9.5.6GHSA-j8r2-47rx-qhw4
Ubuntu:25.10robocodeno fix listedUBUNTU-CVE-2025-14306
Ubuntu:26.10robocodeno fix listedUBUNTU-CVE-2025-14306

Affected products (as reported)

VendorProductVersions
Robocode Project Robocode 1.9.3.6

Weakness: CWE-22 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:Y/R:U/V:D/RE:M/U:Red

References