{"id":"CVE-2025-14306","aliases":["DEBIAN-CVE-2025-14306","EUVD-2025-201886","GHSA-j8r2-47rx-qhw4","UBUNTU-CVE-2025-14306","USN-8385-1"],"status":"published","title":"Directory Traversal in Robocode's CacheCleaner Component","description":"A directory traversal vulnerability exists in the CacheCleaner component of Robocode version 1.9.3.6. The recursivelyDelete method fails to properly sanitize file paths, allowing attackers to traverse directories and delete arbitrary files on the system. This vulnerability can be exploited by submitting specially crafted inputs that manipulate the file path, leading to potential unauthorized file deletions.  https://robo-code.blogspot.com/","severity":{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:Y/R:U/V:D/RE:M/U:Red","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.01142,"percentile":0.67082,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2025-12-09T07:19:29Z","modified":"2026-10-28T10:45:09Z","fixes":[{"ecosystem":"Maven","package":"net.sf.robocode:robocode.core","fixed_in":["1.9.5.6"],"sources":["ghsa","osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"robocode","fixed_in":["1.9.2.5-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"robocode","fixed_in":["1.9.3.1-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"robocode","fixed_in":["1.9.3.7-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"robocode","fixed_in":["1.9.3.9-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"robocode","fixed_in":["1.9.3.9-3ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:26.04:LTS","package":"robocode","fixed_in":["1.9.3.9-4ubuntu0.26.04.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"net.sf.robocode:robocode.core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.5.6"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.3.9-3","1.9.3.9-4","1.9.3.9-5"]},{"source":"osv","ecosystem":"Debian:13","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.3.9-4","1.9.3.9-5"]},{"source":"osv","ecosystem":"Debian:14","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.3.9-4","1.9.3.9-5"]},{"source":"osv","ecosystem":"Maven","package":"net.sf.robocode:robocode.core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.5.6"}]}],"versions":["1.9.4.0","1.9.4.1","1.9.4.2","1.9.4.3","1.9.4.5","1.9.4.6","1.9.4.7","1.9.4.8","1.9.5.0","1.9.5.1","1.9.5.2","1.9.5.3","1.9.5.4","1.9.5.5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2.5-2ubuntu0.1~esm1"}]}],"versions":["1.9.2.4-2","1.9.2.5-1","1.9.2.5-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3.1-1ubuntu0.1~esm1"}]}],"versions":["1.9.2.6-3","1.9.3.1-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3.7-1ubuntu0.1~esm1"}]}],"versions":["1.9.3.5-1","1.9.3.7-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3.9-2ubuntu0.1~esm1"}]}],"versions":["1.9.3.9-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3.9-3ubuntu0.1~esm1"}]}],"versions":["1.9.3.9-3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.3.9-4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.3.9-4build1","1.9.3.9-5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3.9-4ubuntu0.26.04.1~esm1"}]}],"versions":["1.9.3.9-4","1.9.3.9-4build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2.5-2ubuntu0.1~esm1"}]}],"versions":["1.9.2.4-2","1.9.2.5-1","1.9.2.5-2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3.1-1ubuntu0.1~esm1"}]}],"versions":["1.9.2.6-3","1.9.3.1-1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3.7-1ubuntu0.1~esm1"}]}],"versions":["1.9.3.5-1","1.9.3.7-1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3.9-2ubuntu0.1~esm1"}]}],"versions":["1.9.3.9-2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3.9-3ubuntu0.1~esm1"}]}],"versions":["1.9.3.9-3"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3.9-4ubuntu0.26.04.1~esm1"}]}],"versions":["1.9.3.9-4","1.9.3.9-4build1"],"bundled":4}],"products":[{"vendor":"robocode","product":"robocode"},{"vendor":"robocode project","product":"robocode"}],"references":[{"url":"https://github.com/robo-code/robocode/pull/67","tags":["Issue Tracking","Vendor Advisory","fix","web","report"]},{"url":"https://github.com/robo-code/robocode/commit/26b6ba8ed5b2a11a646ce2d5da8d42cd53574b1f","tags":["fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-14306","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-j8r2-47rx-qhw4"},{"url":"https://robocode.sourceforge.io/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/14xxx/CVE-2025-14306.json","tags":["advisory"]},{"url":"https://github.com/robo-code/robocode","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-14306","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-14306","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-14306","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8385-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-10648","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-14307","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-14308","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-14306","title":"Directory Traversal in Robocode's CacheCleaner Component","description":"A directory traversal vulnerability exists in the CacheCleaner component of Robocode version 1.9.3.6. The recursivelyDelete method fails to properly sanitize file paths, allowing attackers to traverse directories and delete arbitrary files on the system. This vulnerability can be exploited by submitting specially crafted inputs that manipulate the file path, leading to potential unauthorized file deletions.  https://robo-code.blogspot.com/","status":"published","published":"2025-12-09T07:19:29.686Z","modified":"2026-01-28T19:46:04.687Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:Y/R:U/V:D/RE:M/U:Red","level":"critical","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:32:28.250136Z"}],"euvd":[{"id":"EUVD-2025-201886","description":"A directory traversal vulnerability exists in the CacheCleaner component of Robocode version 1.9.3.6. The recursivelyDelete method fails to properly sanitize file paths, allowing attackers to traverse directories and delete arbitrary files on the system. This vulnerability can be exploited by submitting specially crafted inputs that manipulate the file path, leading to potential unauthorized file deletions.  https://robo-code.blogspot.com/","status":"published","published":"2025-12-09T07:19:29Z","modified":"2026-01-28T19:46:04Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:Y/R:U/V:D/RE:M/U:Red","level":"critical"}],"updated_at":"2026-11-02T19:48:46.416428Z"}],"ghsa":[{"id":"GHSA-j8r2-47rx-qhw4","title":"Robocode vulnerable to Directory Traversal in recursivelyDelete Method","description":"A directory traversal vulnerability exists in the CacheCleaner component of Robocode version 1.9.3.6. The recursivelyDelete method fails to properly sanitize file paths, allowing attackers to traverse directories and delete arbitrary files on the system. This vulnerability can be exploited by submitting specially crafted inputs that manipulate the file path, leading to potential unauthorized file deletions.","status":"published","published":"2025-12-09T18:30:35Z","modified":"2025-12-09T22:50:23Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:Y/R:U/V:D/RE:M/U:Red","level":"critical"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:39:12.222121Z"}],"nvd":[{"id":"CVE-2025-14306","description":"A directory traversal vulnerability exists in the CacheCleaner component of Robocode version 1.9.3.6. The recursivelyDelete method fails to properly sanitize file paths, allowing attackers to traverse directories and delete arbitrary files on the system. This vulnerability can be exploited by submitting specially crafted inputs that manipulate the file path, leading to potential unauthorized file deletions.  https://robo-code.blogspot.com/","status":"published","published":"2025-12-09T16:17:38.477Z","modified":"2026-10-15T19:10:00.173Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:D/RE:M/U:Red","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:11:49.093461Z"}],"osv":[{"id":"CVE-2025-14306","title":"Directory Traversal in Robocode's CacheCleaner Component","description":"A directory traversal vulnerability exists in the CacheCleaner component of Robocode version 1.9.3.6. The recursivelyDelete method fails to properly sanitize file paths, allowing attackers to traverse directories and delete arbitrary files on the system. This vulnerability can be exploited by submitting specially crafted inputs that manipulate the file path, leading to potential unauthorized file deletions.  https://robo-code.blogspot.com/","status":"published","published":"2025-12-09T07:19:29.686Z","modified":"2026-10-28T10:45:09.539965421Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:Y/R:U/V:D/RE:M/U:Red","level":"critical"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:44:46.340268Z"},{"id":"DEBIAN-CVE-2025-14306","description":"A directory traversal vulnerability exists in the CacheCleaner component of Robocode version 1.9.3.6. The recursivelyDelete method fails to properly sanitize file paths, allowing attackers to traverse directories and delete arbitrary files on the system. This vulnerability can be exploited by submitting specially crafted inputs that manipulate the file path, leading to potential unauthorized file deletions.  https://robo-code.blogspot.com/","status":"published","published":"2025-12-09T16:17:38.477Z","modified":"2026-10-16T09:47:36.097799048Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:45.102284Z"},{"id":"GHSA-j8r2-47rx-qhw4","title":"Robocode vulnerable to Directory Traversal in recursivelyDelete Method","description":"A directory traversal vulnerability exists in the CacheCleaner component of Robocode version 1.9.3.6. The recursivelyDelete method fails to properly sanitize file paths, allowing attackers to traverse directories and delete arbitrary files on the system. This vulnerability can be exploited by submitting specially crafted inputs that manipulate the file path, leading to potential unauthorized file deletions.","status":"published","published":"2025-12-09T18:30:35Z","modified":"2025-12-09T23:12:49.685155Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:Y/R:U/V:D/RE:M/U:Red","level":"critical"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:50.336262Z"},{"id":"UBUNTU-CVE-2025-14306","description":"A directory traversal vulnerability exists in the CacheCleaner component of Robocode version 1.9.3.6. The recursivelyDelete method fails to properly sanitize file paths, allowing attackers to traverse directories and delete arbitrary files on the system. This vulnerability can be exploited by submitting specially crafted inputs that manipulate the file path, leading to potential unauthorized file deletions.  https://robo-code.blogspot.com/","status":"published","published":"2025-12-09T16:17:00Z","modified":"2026-10-17T12:57:01.098729631Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:Y/R:U/V:D/RE:M/U:Red","level":"critical"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:55:20.144818Z"},{"id":"USN-8385-1","title":"robocode vulnerabilities","description":"It was discovered that Robocode could be tricked into making network\nrequests to attacker-controlled systems. An attacker could possibly use\nthis issue to cause external service interaction, resulting in\ninformation disclosure. This issue only affected Ubuntu 16.04 LTS and\nUbuntu 18.04 LTS. (CVE-2019-10648)\n\nLim Sim Yee discovered that Robocode did not properly validate file\npaths in the CacheCleaner component. An attacker could possibly use this\nissue to delete arbitrary files. (CVE-2025-14306)\n\nLim Sim Yee discovered that Robocode did not securely create temporary\nfiles in the AutoExtract component. An attacker could possibly use this\nissue to manipulate temporary files, resulting in arbitrary code\nexecution. (CVE-2025-14307)\n\nLim Sim Yee discovered that Robocode did not properly validate data\nlengths in the Buffer class. An attacker could possibly use this issue\nto trigger an integer overflow, resulting in arbitrary code execution.\n(CVE-2025-14308)","status":"published","published":"2026-06-04T13:59:44Z","modified":"2026-06-04T23:03:42.629564035Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}