{"id":"CVE-2025-14307","aliases":["DEBIAN-CVE-2025-14307","EUVD-2025-201885","GHSA-2mxr-rc97-xrj2","UBUNTU-CVE-2025-14307","USN-8385-1"],"status":"published","title":"Insecure Temporary File Creation in Robocode's AutoExtract Component","description":"An insecure temporary file creation vulnerability exists in the AutoExtract component of Robocode version 1.9.3.6. The createTempFile method fails to securely create temporary files, allowing attackers to exploit race conditions and potentially execute arbitrary code or overwrite critical files. This vulnerability can be exploited by manipulating the temporary file creation process, leading to potential unauthorized actions.","severity":{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:Y/R:U/V:D/RE:M/U:Red","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00353,"percentile":0.29236,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-377"],"published":"2025-12-09T07:29:52Z","modified":"2026-10-17T12:56:48Z","fixes":[{"ecosystem":"Maven","package":"net.sf.robocode:robocode.battle","fixed_in":["1.9.5.6"],"sources":["ghsa","osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"robocode","fixed_in":["1.9.2.5-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"robocode","fixed_in":["1.9.3.1-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"robocode","fixed_in":["1.9.3.7-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"robocode","fixed_in":["1.9.3.9-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"robocode","fixed_in":["1.9.3.9-3ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:26.04:LTS","package":"robocode","fixed_in":["1.9.3.9-4ubuntu0.26.04.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"net.sf.robocode:robocode.battle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.5.6"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.3.9-3","1.9.3.9-4","1.9.3.9-5"]},{"source":"osv","ecosystem":"Debian:13","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.3.9-4","1.9.3.9-5"]},{"source":"osv","ecosystem":"Debian:14","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.3.9-4","1.9.3.9-5"]},{"source":"osv","ecosystem":"Maven","package":"net.sf.robocode:robocode.battle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.5.6"}]}],"versions":["1.9.4.0","1.9.4.1","1.9.4.2","1.9.4.3","1.9.4.5","1.9.4.6","1.9.4.7","1.9.4.8","1.9.5.0","1.9.5.1","1.9.5.2","1.9.5.3","1.9.5.4","1.9.5.5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2.5-2ubuntu0.1~esm1"}]}],"versions":["1.9.2.4-2","1.9.2.5-1","1.9.2.5-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3.1-1ubuntu0.1~esm1"}]}],"versions":["1.9.2.6-3","1.9.3.1-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3.7-1ubuntu0.1~esm1"}]}],"versions":["1.9.3.5-1","1.9.3.7-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3.9-2ubuntu0.1~esm1"}]}],"versions":["1.9.3.9-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3.9-3ubuntu0.1~esm1"}]}],"versions":["1.9.3.9-3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.3.9-4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.3.9-4build1","1.9.3.9-5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3.9-4ubuntu0.26.04.1~esm1"}]}],"versions":["1.9.3.9-4","1.9.3.9-4build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.2.5-2ubuntu0.1~esm1"}]}],"versions":["1.9.2.4-2","1.9.2.5-1","1.9.2.5-2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3.1-1ubuntu0.1~esm1"}]}],"versions":["1.9.2.6-3","1.9.3.1-1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3.7-1ubuntu0.1~esm1"}]}],"versions":["1.9.3.5-1","1.9.3.7-1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3.9-2ubuntu0.1~esm1"}]}],"versions":["1.9.3.9-2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3.9-3ubuntu0.1~esm1"}]}],"versions":["1.9.3.9-3"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"robocode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.3.9-4ubuntu0.26.04.1~esm1"}]}],"versions":["1.9.3.9-4","1.9.3.9-4build1"],"bundled":4}],"products":[{"vendor":"robocode","product":"robocode"},{"vendor":"robocode project","product":"robocode"}],"references":[{"url":"https://github.com/robo-code/robocode/pull/68","tags":["Issue Tracking","Vendor Advisory","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-14307","tags":["advisory"]},{"url":"https://github.com/robo-code/robocode/commit/9f882bba2a9cd91da57c16b98699f8cc9b354f3a","tags":["web"]},{"url":"https://github.com/advisories/GHSA-2mxr-rc97-xrj2"},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-14307","tags":["advisory"]},{"url":"https://github.com/robo-code/robocode","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2025-14307","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-14307","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8385-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-10648","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-14306","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-14308","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-14307","title":"Insecure Temporary File Creation in Robocode's AutoExtract Component","description":"An insecure temporary file creation vulnerability exists in the AutoExtract component of Robocode version 1.9.3.6. The createTempFile method fails to securely create temporary files, allowing attackers to exploit race conditions and potentially execute arbitrary code or overwrite critical files. This vulnerability can be exploited by manipulating the temporary file creation process, leading to potential unauthorized actions.","status":"published","published":"2025-12-09T07:29:52.225Z","modified":"2025-12-09T16:02:14.88Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:Y/R:U/V:D/RE:M/U:Red","level":"critical","assessor":"cna"}],"cwes":["CWE-377"],"updated_at":"2026-11-02T14:32:28.250136Z"}],"euvd":[{"id":"EUVD-2025-201885","description":"An insecure temporary file creation vulnerability exists in the AutoExtract component of Robocode version 1.9.3.6. The createTempFile method fails to securely create temporary files, allowing attackers to exploit race conditions and potentially execute arbitrary code or overwrite critical files. This vulnerability can be exploited by manipulating the temporary file creation process, leading to potential unauthorized actions.","status":"published","published":"2025-12-09T07:29:52Z","modified":"2025-12-09T16:02:14Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:Y/R:U/V:D/RE:M/U:Red","level":"critical"}],"updated_at":"2026-11-02T19:49:08.049254Z"}],"ghsa":[{"id":"GHSA-2mxr-rc97-xrj2","title":"Robocode has an insecure temporary file creation vulnerability in the AutoExtract component","description":"An insecure temporary file creation vulnerability exists in the AutoExtract component of Robocode version 1.9.3.6. The createTempFile method fails to securely create temporary files, allowing attackers to exploit race conditions and potentially execute arbitrary code or overwrite critical files. This vulnerability can be exploited by manipulating the temporary file creation process, leading to potential unauthorized actions.","status":"published","published":"2025-12-09T18:30:35Z","modified":"2025-12-10T00:02:37Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:Y/R:U/V:D/RE:M/U:Red","level":"critical"}],"cwes":["CWE-377"],"updated_at":"2026-11-02T14:39:12.222121Z"}],"nvd":[{"id":"CVE-2025-14307","description":"An insecure temporary file creation vulnerability exists in the AutoExtract component of Robocode version 1.9.3.6. The createTempFile method fails to securely create temporary files, allowing attackers to exploit race conditions and potentially execute arbitrary code or overwrite critical files. This vulnerability can be exploited by manipulating the temporary file creation process, leading to potential unauthorized actions.","status":"published","published":"2025-12-09T16:17:38.64Z","modified":"2026-10-15T19:10:00.173Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:D/RE:M/U:Red","level":"critical","assessor":"secondary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-377"],"updated_at":"2026-11-02T14:11:49.093461Z"}],"osv":[{"id":"CVE-2025-14307","description":"An insecure temporary file creation vulnerability exists in the AutoExtract component of Robocode version 1.9.3.6. The createTempFile method fails to securely create temporary files, allowing attackers to exploit race conditions and potentially execute arbitrary code or overwrite critical files. This vulnerability can be exploited by manipulating the temporary file creation process, leading to potential unauthorized actions.","status":"published","published":"2025-12-09T16:17:38.64Z","modified":"2026-04-10T05:21:28.081414Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:46.340268Z"},{"id":"DEBIAN-CVE-2025-14307","description":"An insecure temporary file creation vulnerability exists in the AutoExtract component of Robocode version 1.9.3.6. The createTempFile method fails to securely create temporary files, allowing attackers to exploit race conditions and potentially execute arbitrary code or overwrite critical files. This vulnerability can be exploited by manipulating the temporary file creation process, leading to potential unauthorized actions.","status":"published","published":"2025-12-09T16:17:38.64Z","modified":"2026-10-16T09:47:27.845121981Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:45.102284Z"},{"id":"GHSA-2mxr-rc97-xrj2","title":"Robocode has an insecure temporary file creation vulnerability in the AutoExtract component","description":"An insecure temporary file creation vulnerability exists in the AutoExtract component of Robocode version 1.9.3.6. The createTempFile method fails to securely create temporary files, allowing attackers to exploit race conditions and potentially execute arbitrary code or overwrite critical files. This vulnerability can be exploited by manipulating the temporary file creation process, leading to potential unauthorized actions.","status":"published","published":"2025-12-09T18:30:35Z","modified":"2025-12-10T00:41:16.067577Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:Y/R:U/V:D/RE:M/U:Red","level":"critical"}],"cwes":["CWE-377"],"updated_at":"2026-11-02T15:46:34.700741Z"},{"id":"UBUNTU-CVE-2025-14307","description":"An insecure temporary file creation vulnerability exists in the AutoExtract component of Robocode version 1.9.3.6. The createTempFile method fails to securely create temporary files, allowing attackers to exploit race conditions and potentially execute arbitrary code or overwrite critical files. This vulnerability can be exploited by manipulating the temporary file creation process, leading to potential unauthorized actions.","status":"published","published":"2025-12-09T16:17:00Z","modified":"2026-10-17T12:56:48.075852969Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:Y/R:U/V:D/RE:M/U:Red","level":"critical"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:20.144818Z"},{"id":"USN-8385-1","title":"robocode vulnerabilities","description":"It was discovered that Robocode could be tricked into making network\nrequests to attacker-controlled systems. An attacker could possibly use\nthis issue to cause external service interaction, resulting in\ninformation disclosure. This issue only affected Ubuntu 16.04 LTS and\nUbuntu 18.04 LTS. (CVE-2019-10648)\n\nLim Sim Yee discovered that Robocode did not properly validate file\npaths in the CacheCleaner component. An attacker could possibly use this\nissue to delete arbitrary files. (CVE-2025-14306)\n\nLim Sim Yee discovered that Robocode did not securely create temporary\nfiles in the AutoExtract component. An attacker could possibly use this\nissue to manipulate temporary files, resulting in arbitrary code\nexecution. (CVE-2025-14307)\n\nLim Sim Yee discovered that Robocode did not properly validate data\nlengths in the Buffer class. An attacker could possibly use this issue\nto trigger an integer overflow, resulting in arbitrary code execution.\n(CVE-2025-14308)","status":"published","published":"2026-06-04T13:59:44Z","modified":"2026-06-04T23:03:42.629564035Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}