CVE-2025-14306 Directory Traversal in Robocode's CacheCleaner Component

What is CVE-2025-14306?

CVE-2025-14306 is a critical path traversal vulnerability in Robocode, published on 9 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A directory traversal vulnerability exists in the CacheCleaner component of Robocode version 1.9.3.6. The recursivelyDelete method fails to properly sanitize file paths, allowing attackers to traverse directories and delete arbitrary files on the system. This vulnerability can be exploited by submitting specially crafted inputs that manipulate the file path, leading to potential unauthorized file deletions. https://robo-code.blogspot.com/

Weakness: CWE-22

Which versions are affected by CVE-2025-14306?

2 open source packages ship an affected version, including net.sf.robocode:robocode.core. It affects 1 product.

Products include Robocode Robocode.

How do I fix CVE-2025-14306?

Upgrade net.sf.robocode:robocode.core to 1.9.5.6 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2025-14306 being exploited?

There is no known exploitation of CVE-2025-14306 in the wild and no public exploit code.

Other vulnerabilities in Robocode

• CVE-2025-14308 Integer Overflow in Robocode's Buffer Write Method Critical 10.0
• CVE-2019-10648 Improper Input Validation in net.sf.robocode:robocode.host allows for external service interaction Critical 9.8
• CVE-2025-14307 Insecure Temporary File Creation in Robocode's AutoExtract Component Critical 9.3
• CVE-2008-2078 Other in n/a High 7.5
• CVE-2007-6382 Robocode Arbitrary Code Execution Medium 6.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2025-14306, GHSA-j8r2-47rx-qhw4, UBUNTU-CVE-2025-14306.