CVE-2025-62784CWE-837

CVE-2025-62784

Medium · published October 28, 2025

CVSS v3.1

5.3

EPSS

Percentile

12.3

In the wild

Unconfirmed

What it is

InventoryGui is a library for creating chest GUIs for Bukkit/Spigot plugins. Versions before 1.6.5 contain a vulnerability where any plugin using a GUI with the GuiStorageElement and allows taking out items out of that element can allow item duplication when the experimental Bundle item feature is enabled on the server. The vulnerability is resolved in version 1.6.5.

The record

Technical detail

CVSS v3.1: 5.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00223 · 12.3th percentile
Weakness: CWE-837 · Improper Enforcement of a Single, Unique Action
Published: 2025-10-28T01:15Z

Affected products (1)

Product	Versions	Fixed in
phoenix616/inventorygui	< 1.6.5	1.6.5

References (2)

https://github.com/Phoenix616/InventoryGui/commit/690fc91d137c6cc04f6ed3a89449050964dd8cb9 · [email protected]https://github.com/Phoenix616/InventoryGui/security/advisories/GHSA-7whh-79j3-7c55 · [email protected]

EPSS history

Timeline

27 OCT 20:59Z
InventoryGui allows item duplication in GUIs which use GuiStorageElement
cvelistv5