Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-62782: InventoryGui: Item Duplication in GUIs with Bundle Items

CVE-2025-62782 · published 1 year ago

Summary

A security issue in older versions of InventoryGui can allow players to duplicate items in certain GUIs on Bukkit/Spigot servers. This means that players could potentially get more items than they should. To fix this, update to version 1.6.4-SNAPSHOT or later to prevent item duplication.

What to do

Update themoep de.themoep:inventorygui to version 1.6.4-SNAPSHOT.
Update phoenix616 inventorygui to version 1.6.4 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
maven	themoep	de.themoep:inventorygui	<= 1.6.3-SNAPSHOT Fix: upgrade to 1.6.4-SNAPSHOT
–	phoenix616	inventorygui	< 1.6.4 `cpe:2.3:a:phoenix616:inventorygui::::::::`

Original advisory text

InventoryGUI vulnerable to item duplication via Bundle items when using GuiStorageElement

InventoryGui is a library for creating chest GUIs for Bukkit/Spigot plugins. Versions 1.6.3-SNAPSHOT and earlier contain a vulnerability where GUIs using GuiStorageElement can allow item duplication when the experimental Bundle item feature is enabled on the server. The vulnerability is resolved in version 1.6.4-SNAPSHOT.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-62782 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62782... Vendor Advisory
https://github.com/advisories/GHSA-rgvh-4m82-fvjq
https://github.com/Phoenix616/InventoryGui/security/advisories/GHSA-rgvh-4m82-fv... Vendor Advisory
https://github.com/Phoenix616/InventoryGui/issues/51 Third Party Advisory
https://github.com/Phoenix616/InventoryGui/commit/00e684bd689ebc60bcb5b83ce4ef3c... Patch

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

8.1 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-837Improper Enforcement of a Single, Unique Action

Timeline

Published27 Oct 2025

Updated4 Nov 2026

First seen6 Mar 2026

Sources

GHSA-rgvh-4m82-fvjq · GHSA

CVE-2025-62782 · NVD

CVE-2025-62782 · OSV

Track software like this

Free during beta