CVE-2025-14306
BaseFortify
Publication date: 2025-12-09
Last updated on: 2025-12-09
Assigner: Government Technology Agency of Singapore Cyber Security Group (GovTech CSG)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| robo_code | robocode | 1.9.3.6 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a directory traversal issue in the CacheCleaner component of Robocode version 1.9.3.6. The method recursivelyDelete does not properly sanitize file paths, which allows attackers to manipulate the file path input to traverse directories and delete arbitrary files on the system.
How can this vulnerability impact me? :
An attacker can exploit this vulnerability to delete arbitrary files on the affected system without authorization, potentially causing data loss, system instability, or disruption of services.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves checking if the Robocode version 1.9.3.6 or earlier is running and if the recursivelyDelete method is being called with unsanitized or user-controlled file paths. Since the vulnerability allows directory traversal leading to arbitrary file deletions, monitoring logs for unexpected file deletion attempts outside the intended directories can help. Additionally, reviewing the code or binaries to verify if the fix (path canonicalization and base directory checks) from pull request #67 is applied can confirm if the system is vulnerable. Specific commands are not provided in the resources. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating Robocode to a version that includes the fix from pull request #67, which enforces strict path canonicalization and validation against a defined base directory in the recursivelyDelete method. If an update is not immediately possible, restrict access to the CacheCleaner component to trusted users only, monitor file deletion activities closely, and consider applying the patch manually if feasible. The fix prevents directory traversal by ensuring that file deletions cannot occur outside the allowed base directory. [1]