CVE-2025-62783
MediumCVSS 5.0Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
InventoryGui library up to version 1.6.1-SNAPSHOT allows item duplication in any plugin using GuiStorageElement when the experimental Bundle item feature is enabled on the server. The vulnerability is fixed in version 1.6.2-SNAPSHOT.
Risk Assessment
Item duplication can break the game server economy, enable unfair resource acquisition, and disrupt gameplay. The issue affects all plugins relying on this library.
Recommendation
Upgrade InventoryGui to version 1.6.2-SNAPSHOT or later. Until then, consider disabling the experimental Bundle feature on the server.
Other vulnerabilities in InventoryGui
See all- CVE-2025-62784Medium
The InventoryGui library for creating chest GUIs for Bukkit/Spigot plugins, in versions before 1.6.5, contains a vulnerability where any plugin using a GUI with the GuiStorageElement and allowing taking out items can allow item duplication when the experimental Bundle item feature is enabled. The vulnerability is resolved in version 1.6.5.
- CVE-2025-62782Medium
InventoryGui is a library for creating chest GUIs for Bukkit/Spigot plugins. Versions 1.6.3-SNAPSHOT and earlier contain a vulnerability where GUIs using GuiStorageElement can allow item duplication when the experimental Bundle item feature is enabled on the server.
Original NVD description (English source)
InventoryGui is a library for creating chest GUIs for Bukkit/Spigot plugins. Versions 1.6.1-SNAPSHOT and earlier contain a vulnerability where any plugin using the `GuiStorageElement can allow item duplication when the experimental Bundle item feature is enabled on the server. The vulnerability is resolved in version 1.6.2-SNAPSHOT.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS