GitHub Advisoryadvisory · Maven

GHSA-j8r2-47rx-qhw4 Robocode vulnerable to Directory Traversal in recursivelyDelete Method

CRITICAL Published 2025-12-09 Modified 2025-12-09 Official page ↗
Aliases
CVE-2025-14306
Ecosystem
Maven
Packages
net.sf.robocode:robocode.core
Severity
Critical
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:Y/R:U/V:D/RE:M/U:Red
Weaknesses
CWE-22
Reviewed
2025-12-09

Affected packages

• Maven net.sf.robocode:robocode.core: < 1.9.5.6 → fixed in 1.9.5.6

Description

A directory traversal vulnerability exists in the CacheCleaner component of Robocode version 1.9.3.6. The recursivelyDelete method fails to properly sanitize file paths, allowing attackers to traverse directories and delete arbitrary files on the system. This vulnerability can be exploited by submitting specially crafted inputs that manipulate the file path, leading to potential unauthorized file deletions.

Related

Alias · CVE (1)

  • CVE-2025-14306 A directory traversal vulnerability exists in the CacheCleaner component of Robocode version 1.9.3.6. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References