CVE-2025-14306: 
Java vulnerability analysis and mitigation

CVE-2025-14306 is a directory traversal vulnerability in the CacheCleaner component of Robocode, a Java-based robot battle simulation platform. The flaw exists in the recursivelyDelete method of CacheCleaner.java, which fails to properly sanitize file paths, enabling attackers to delete arbitrary files outside the intended directory. It affects Robocode versions prior to 1.9.5.6 (specifically confirmed in version 1.9.3.6). The vulnerability was published on December 9, 2025, with a patch merged on May 13, 2025. It carries a CVSS v3.1 base score of 9.1 (Critical) and a CVSS v4.0 base score of 10.0 (Critical) (GitHub Advisory, GitHub PR).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The vulnerable recursivelyDelete method in net.sf.robocode.cachecleaner.CacheCleaner accepted a File argument without validating that the resolved canonical path remained within a permitted base directory, allowing path traversal sequences (e.g., ../) to escape the intended cache directory. An unauthenticated remote attacker with network access to the Robocode service can submit a specially crafted file path input that causes the method to recursively delete files anywhere on the filesystem accessible to the Robocode process. The fix, contributed via GitHub PR #67, adds a base directory parameter and enforces file.getCanonicalFile().toPath().startsWith(base.getCanonicalFile().toPath()) before any deletion, along with null checks and proper exception handling (GitHub PR, GitHub Advisory).

Successful exploitation allows an unauthenticated remote attacker to delete arbitrary files on the host system, limited only by the permissions of the Robocode process. This can result in destruction of critical system files, application data loss, and denial of service by rendering the system or dependent services inoperable. While the vulnerability does not directly expose confidential data (no confidentiality impact in CVSS v3.1), the ability to delete configuration files, credentials stores, or system binaries could facilitate further compromise or lateral movement (GitHub Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of publication (GitHub Advisory). The vulnerability is highly automatable (CVSS v4.0 Automatable: YES) and requires no authentication, privileges, or user interaction, making it straightforward to exploit over the network. The EPSS score is approximately 0.643% (71st percentile), indicating a moderate relative probability of exploitation within 30 days. The CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported (GitHub Advisory).

1. Reconnaissance: Identify internet-facing or network-accessible Robocode instances running version 1.9.3.6 or earlier (Maven artifact net.sf.robocode:robocode.core < 1.9.5.6) using network scanning tools or dependency inventory systems.
2. Identify the vulnerable endpoint: Locate the interface or API through which the Robocode CacheCleaner component accepts file path inputs for cache management operations.
3. Craft a malicious path: Construct a file path input containing directory traversal sequences (e.g., ../../etc/passwd or ../../critical/config/file) designed to resolve outside the intended cache base directory.
4. Submit the payload: Send the crafted path to the vulnerable recursivelyDelete method via the applicable network interface, triggering recursive deletion of the targeted file or directory tree.
5. Achieve objective: The method deletes the specified files outside the cache directory without authorization, potentially causing denial of service, data loss, or enabling further system compromise (GitHub PR, GitHub Advisory).

• Logs: Application or system logs showing unexpected file deletion events outside the Robocode cache directory; Java stack traces or IOException messages referencing paths outside the expected base directory (post-patch: "Security violation: Attempting to delete a file outside the allowed base directory").
• File System: Missing or unexpectedly deleted files in directories unrelated to the Robocode cache (e.g., /etc/, application config directories, or user home directories); sudden disappearance of critical system or application files.
• Process: Robocode Java process (java with net.sf.robocode classpath) performing file system operations on paths outside its expected working or cache directory, observable via process monitoring tools (e.g., auditd, inotifywait on Linux).
• Network: Unusual or repeated network requests to Robocode services containing path traversal sequences (../, %2e%2e%2f, or URL-encoded variants) in file path parameters.

Upgrade the Maven artifact net.sf.robocode:robocode.core to version 1.9.5.6 or later, which includes the fix merged via GitHub PR #67 on May 13, 2025 (GitHub PR, GitHub Advisory). As an interim workaround, implement network access controls to restrict access to Robocode services to trusted hosts only, reducing the attack surface. Monitor systems for suspicious file deletion activity and unauthorized directory traversal attempts in application logs until patching is complete.

The vulnerability was discovered and responsibly disclosed by contributor simei2k, who submitted both the bug report and the fix via GitHub PR #67. Robocode maintainer flemming-n-larsen acknowledged the issue, reviewed the fix positively, and merged it on May 13, 2025, explicitly encouraging the reporter to submit a formal CVE (GitHub PR). The advisory was subsequently published to the GitHub Advisory Database and picked up by vulnerability tracking platforms including Tenable Nessus, Qualys, and ENISA's EUVD. No significant broader media coverage or social media discussion has been observed beyond standard vulnerability database aggregation.