CVE-2025-14306: Directory Traversal in Robocode Core

The impact of this vulnerability is significant. An attacker who successfully exploits CVE-2025-14306 can gain unauthorized access to delete files on the system where Robocode Core is running. This could lead to data loss, system instability, or even denial of service. The recursiveDelete method's failure to properly sanitize file paths is the root cause, enabling attackers to bypass intended security controls. The potential for widespread damage depends on the permissions granted to the Robocode process and the sensitivity of the files it has access to. While Robocode is primarily a programming education tool, its use in automated trading or other sensitive contexts could amplify the impact significantly.

1. Reserved2025-12-09
2. Published2025-12-09
3. EPSS updated2026-03-23

The primary mitigation for CVE-2025-14306 is to upgrade Robocode Core to version 1.9.5.6 or later. If upgrading is not immediately feasible, consider restricting the permissions of the Robocode process to minimize the potential damage from unauthorized file deletions. While a direct WAF rule is unlikely to be effective due to the nature of the vulnerability, monitoring file system activity for unexpected deletions originating from the Robocode process can provide an early warning. There are no specific Sigma or YARA rules readily available for this vulnerability, but monitoring for unusual file deletion patterns within the Robocode directory is recommended.