by Kastro
Paper/Archive/CVE-2025-14307

CVE-2025-14307

Robocode Project Robocode — Insecure Temporary File Creation in Robocode's AutoExtract Component

EPSS 0.3%CVSS 9.3
critical.is priorityof 100
33
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 26.4.264 × 205.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An insecure temporary file creation vulnerability exists in the AutoExtract component of Robocode version 1.9.3.6. The createTempFile method fails to securely create temporary files, allowing attackers to exploit race conditions and potentially execute arbitrary code or overwrite critical files. This vulnerability can be exploited by manipulating the temporary file creation process, leading to potential unauthorized actions.

Affected

ProductAffectedFixed inSource
Robocode1.9.3.6–CNA

Scores by source

GovTech CSG (CNA)9.3CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:Y/R:U/V:D/RE:M/U:Red
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/robo-code/robocode/pull/68