10

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-14306

CVE-2025-14306: Directory Traversal in Robocode's CacheCleaner Component

A directory traversal vulnerability exists in the CacheCleaner component of Robocode version 1.9.3.6. The recursivelyDelete method fails to properly sanitize file paths, allowing attackers to traverse directories and delete arbitrary files on the system. This vulnerability can be exploited by submitting specially crafted inputs that manipulate the file path, leading to potential unauthorized file deletions. https://robo-code.blogspot.com/

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-14306

CVE-2025-14306:

10

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
net.sf.robocode:robocode.core	maven	< 1.9.5.6	1.9.5.6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The security vulnerability is a classic directory traversal issue located in the CacheCleaner.recursivelyDelete method of the Robocode application. The analysis of the provided commit 26b6ba8ed5b2a11a646ce2d5da8d42cd53574b1f clearly indicates the flaw and its remediation. The original implementation of recursivelyDelete accepted a File object and proceeded to delete it without verifying if the file's path was confined to a specific, safe directory. This allowed for malicious input to specify paths like ../../../../some/important/file and trick the application into deleting it. The patch rectifies this by introducing a base parameter, which represents the intended root directory for deletion operations. A crucial security check was added to validate that the canonical path of any file or directory to be deleted is a sub-path of the base directory. This prevents the traversal outside the designated directory, thus mitigating the vulnerability. Therefore, the function net.sf.robocode.cachecleaner.CacheCleaner.recursivelyDelete is the exact location of the vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.