CVE-2025-62782: InventoryGUI vulnerable to item duplication via Bundle items when using GuiStorageElement

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-27 · updated 2026-10-08
Weakness: CWE-837

Description

InventoryGui is a library for creating chest GUIs for Bukkit/Spigot plugins. Versions 1.6.3-SNAPSHOT and earlier contain a vulnerability where GUIs using GuiStorageElement can allow item duplication when the experimental Bundle item feature is enabled on the server. The vulnerability is resolved in version 1.6.4-SNAPSHOT.

Affected products

Phoenix616 InventoryGui: before 1.6.4 — fixed in 1.6.4

How to fix

Upgrade to a fixed version: Phoenix616 InventoryGui 1.6.4. Check the vendor advisory for mitigations.

References

https://github.com/Phoenix616/InventoryGui/commit/00e684bd689ebc60bcb5b83ce4ef3c5a01778494
https://github.com/Phoenix616/InventoryGui/issues/51
https://github.com/Phoenix616/InventoryGui/security/advisories/GHSA-rgvh-4m82-fvjq

Get alerted when CVE-2025-62782 or the next vulnerability affects your stack