CVE-2025-62783 InventoryGui affected by item duplication in GUIs which use GuiStorageElement
Attackers can duplicate items in Minecraft server plugins using InventoryGui when experimental Bundle features are enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-62783?
CVE-2025-62783 is a medium-severity vulnerability in Phoenix616 InventoryGui, published on 27 Oct 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
InventoryGui is a library for creating chest GUIs for Bukkit/Spigot plugins. Versions 1.6.1-SNAPSHOT and earlier contain a vulnerability where any plugin using the `GuiStorageElement can allow item duplication when the experimental Bundle item feature is enabled on the server. The vulnerability is resolved in version 1.6.2-SNAPSHOT.
Weakness: CWE-837
Which versions are affected by CVE-2025-62783?
2 open source packages ship an affected version, including de.themoep:inventorygui. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
de.themoep:inventorygui Maven | All versions | 1.6.2-SNAPSHOT |
de.themoep:inventorygui Maven | All versions | 1.6.2-SNAPSHOT |
Products include Phoenix616 Inventorygui.
How do I fix CVE-2025-62783?
Upgrade de.themoep:inventorygui to 1.6.2-SNAPSHOT or later.
Is CVE-2025-62783 being exploited?
There is no known exploitation of CVE-2025-62783 in the wild and no public exploit code.
Other vulnerabilities in Phoenix616 InventoryGui
Sources
Also known as GHSA-598q-jw82-5w66.