Skip to content
OpenAdvisories
Critical · 10.0 CVE-2025-14306 EUVD-2025-201886GHSA-j8r2-47rx-qhw4

Directory Traversal in Robocode's CacheCleaner Component

Published Dec 9, 2025 · Updated Jan 28, 2026 · Assigned by GovTech CSG

Description

A directory traversal vulnerability exists in the CacheCleaner component of Robocode version 1.9.3.6. The recursivelyDelete method fails to properly sanitize file paths, allowing attackers to traverse directories and delete arbitrary files on the system. This vulnerability can be exploited by submitting specially crafted inputs that manipulate the file path, leading to potential unauthorized file deletions. https://robo-code.blogspot.com/

Affected products

VendorProductAffectedFixed
Robocode Project Robocode 1.9.3.6 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 robocode No fix yet —
Debian 13 robocode No fix yet —
Debian 12 robocode No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 robocode No fix yet —
Ubuntu 25.10 robocode No fix yet —
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 26.04 LTS robocode 1.9.3.9-4ubuntu0.26.04.1~esm1 USN-8385-1
Ubuntu Pro 24.04 LTS robocode 1.9.3.9-3ubuntu0.1~esm1 USN-8385-1
Ubuntu Pro 22.04 LTS robocode 1.9.3.9-2ubuntu0.1~esm1 USN-8385-1
Ubuntu Pro 20.04 LTS robocode 1.9.3.7-1ubuntu0.1~esm1 USN-8385-1
Ubuntu Pro 18.04 LTS robocode 1.9.3.1-1ubuntu0.1~esm1 USN-8385-1
Ubuntu Pro 16.04 LTS robocode 1.9.2.5-2ubuntu0.1~esm1 USN-8385-1

Affected packages

EcosystemPackageAffectedFixedRecord
Maven net.sf.robocode:robocode.core < 1.9.5.6 1.9.5.6 GHSA-j8r2-47rx-qhw4

Advisories 1

References