CVE-2025-14306 is a critical severity (CVSS 9.1) path traversal in Robocode 1.9.3.6. The recursivelyDelete method in the CacheCleaner component does not sanitize paths, so it can delete files outside the intended folder. A fix is linked in a pull request and commit. Confirm which release includes it before updating.
What's affected
- Product: Robocode, the Java programming game.
- Affected version: 1.9.3.6, per the record. Other versions are not mentioned.
- Component:
CacheCleaner, methodrecursivelyDelete. - Fix: the record links a pull request and a commit. We did not confirm which published release contains it, so check the project's release notes.
- Weakness: CWE-22 (path traversal). See the Gold page for CVE-2025-14306.
- Severity: Critical, CVSS 9.1, vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. - CISA KEV: not listed.
How to check if you're exposed
Check the Robocode version on the machines that run it. The About dialog shows it, and the installer or jar file name usually includes it. If you see 1.9.3.6, you are in the affected version.
If Robocode is a dependency of a build, a classroom image or a tournament server, search for it there too. In a Java project, look in your build files for the Robocode artifact and its version. Run a dependency scan against the project to list resolved versions, including transitive ones. The free in-browser dependency scan can do this from a manifest.
Reachability matters here. The weakness is in the cache cleaning code, so ask whether the application ever lets untrusted input choose the path that gets cleaned.
What to do now
- Find every Robocode install and build that uses it, and record the version.
- Read the project's release notes and the linked pull request to confirm which release contains the fix, then update to that release.
- Until you update, do not run Robocode with elevated rights, and do not let untrusted users supply file names or settings that reach the cache cleaner.
- Run it under an account with access to only the files it needs.
- Keep backups of directories where Robocode runs, since the flaw concerns deleting files.
- Recheck your dependency scan after updating.
Why it matters
Path traversal lets a path supplied from outside escape the folder the code meant to work in. A recursive delete combined with an unsanitized path is a risky mix, because the damage is not one file but a whole tree. The record scores impact on integrity and availability as high, with no confidentiality impact, which matches a delete only flaw.
The score is critical because the vector shows network reach with no privileges and no user interaction. For a desktop programming game, how much of that applies in practice depends on how you run it. A classroom server or tournament host that accepts uploaded content deserves the most attention. It is not in CISA KEV and the record does not say it is exploited.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which Robocode release fixes CVE-2025-14306?
The record links a pull request and a commit but does not name a release. Check the project's release notes and tags.
Do I need to worry if I only play locally?
Exposure is lower on a single user machine, but still update, and avoid loading robots or settings from sources you do not trust.
Sources
- NVD record data for CVE-2025-14306 (Safeguard Gold entry)
- Public report
- Public report
Last reviewed: 19 October 2026.
