CVE-2025-14306: Directory Traversal Vulnerability in Robocode Core Package
Summary
CVE-2025-14306: Robocode vulnerable to Directory Traversal in recursivelyDelete Method. Affects net.sf.robocode:robocode.core versions < 1.9.5.6. Fixed in 1.9.5.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Robocode is an open-source programming game that allows users to create and control robot tanks in a simulated battle environment. The core package, net.sf.robocode:robocode.core, is essential for the functionality of the game, providing the necessary components for robot behavior and game mechanics. However, a critical vulnerability has been identified in version 1.9.3.6 that could allow unauthorized file deletions due to improper file path sanitization.
Vulnerability Detail
A directory traversal vulnerability exists in the CacheCleaner component of Robocode version 1.9.3.6. The issue arises from the recursivelyDelete method, which fails to properly sanitize file paths. This oversight allows attackers to manipulate file paths through specially crafted inputs, enabling them to traverse directories and delete arbitrary files on the system. The potential ramifications include unauthorized access to sensitive files and significant disruption to system integrity.
How To Fix
Latest published version: 1.11.1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.9.5.6
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict file permissions on the directories that the CacheCleaner component accesses, limiting the potential impact of the vulnerability until an update can be applied.
Conclusion
The directory traversal vulnerability in the Robocode core package poses a serious risk to users, allowing for unauthorized file deletions. It is crucial to update to the patched version 1.9.5.6 to mitigate this risk. Users should also consider implementing additional security measures and regularly monitoring their dependencies for vulnerabilities.
See every vulnerability recorded for net.sf.robocode:robocode.core →
FAQ
A directory traversal vulnerability allows an attacker to access files and directories that are stored outside the intended directory structure, potentially leading to unauthorized file access or deletion.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software by analyzing the pom.xml file. You can also check your application using the Vulert playground without any signup.
The consequences include unauthorized deletion of critical files, potential data loss, and disruption of application functionality.
Yes, if the vulnerability is exploited, there is a significant risk of data loss due to unauthorized file deletions.
It is recommended to regularly check for vulnerabilities, especially after major updates or when new vulnerabilities are disclosed.
References
Related vulnerabilities
Recent vulnerabilities recorded for net.sf.robocode:robocode.core.
