Robocode CVE-2025-14306

Exploitation requires that attacker-influenced data (a robot file/package or other input whose stored file path contains '../' traversal sequences) be present in or supplied to Robocode's cache, and that the victim then trigger the CacheCleaner / recursivelyDelete routine on Robocode version 1.9.3.6. Limiting factors that reduce realistic risk: this is a local desktop application rather than a network service, so the attacker must first get malicious content onto the victim's machine and the victim (or an automated cleanup) must run the vulnerable deletion path; damage is bounded to files writable by the Robocode process's user; and only the specific unpatched 1.9.3.6 build (pre-PR #67) is affected. No authentication model applies in the traditional sense - the constraint is local input control plus execution of the cache cleaner, not credentials.

The input assigns a CVSS 4.0 base score of 10.0 (AV:N/AC:L/PR:N/UI:N with full high impact to both vulnerable and subsequent systems), which overstates real-world risk and conflicts with the nature of the flaw. Robocode is a standalone desktop Java application (a robot-tank programming game); its CacheCleaner operates on a local cache directory, so a true network, zero-interaction attack path (AV:N/UI:N) is not supported by the description - exploitation realistically requires attacker-controlled input to reach the local cache-cleaning routine, implying local vector and some user action. The impact rating also appears inflated: the bug is arbitrary file DELETION (an integrity/availability problem), yet the vector claims VC:H/SC:H confidentiality impact that the description does not substantiate. No EPSS score, no CISA KEV listing, and no proof-of-concept are provided, so there is no public exploit identified at time of analysis; the supplemental metrics (AU:Y automatable, U:Red urgency) are vendor/scorer assertions, not evidence of exploitation. Given a niche educational/hobby product with negligible production footprint and no exploitation signals, this is better characterized as a high-CVSS-but-low-real-world-priority issue rather than an urgent threat. Key conflict to verify with vendor: CVSS indicates network/unauthenticated/no-interaction with confidentiality loss, but the description and source code imply local, input-driven arbitrary file deletion with no data disclosure.

An attacker crafts input (e.g., a robot package or file whose stored path contains directory-traversal sequences) that the victim's Robocode installation processes during cache cleaning; when recursivelyDelete runs, the unsanitized path escapes the cache base directory and deletes files elsewhere on the filesystem that the Robocode process can write to. No public exploit code is identified at time of analysis, but the pre-patch recursivelyDelete method visibly lacks any canonical-path containment check. The practical impact is destruction of arbitrary user-accessible files rather than code execution or data theft.