by Kastro
Paper/Archive/CVE-2025-14306

CVE-2025-14306

Robocode Project Robocode — Directory Traversal in Robocode's CacheCleaner Component

EPSS 1%CVSS 10.0
critical.is priorityof 100
43
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 64.9.649 × 2013.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A directory traversal vulnerability exists in the CacheCleaner component of Robocode version 1.9.3.6. The recursivelyDelete method fails to properly sanitize file paths, allowing attackers to traverse directories and delete arbitrary files on the system. This vulnerability can be exploited by submitting specially crafted inputs that manipulate the file path, leading to potential unauthorized file deletions. https://robo-code.blogspot.com/

Affected

ProductAffectedFixed inSource
Robocode1.9.3.6–CNA

Scores by source

GovTech CSG (CNA)10.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:Y/R:U/V:D/RE:M/U:Red
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/robo-code/robocode/pull/67refgithub.com/robo-code/robocode/commit/26b6ba8ed5b2a11a646ce2d5da8d42cd53574b1f