CVE-2025-62784 json
InventoryGui allows item duplication in GUIs which use GuiStorageElement
published last yr. modified last mo. also GHSA-7whh-79j3-7c55 , EUVD-2025-36361
- cvss
- 5.3
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 13%
- public exploits
- 0
- none known
Summary
InventoryGui is a library for creating chest GUIs for Bukkit/Spigot plugins. Versions before 1.6.5 contain a vulnerability where any plugin using a GUI with the GuiStorageElement and allows taking out items out of that element can allow item duplication when the experimental Bundle item feature is enabled on the server. The vulnerability is resolved in version 1.6.5.
Patch / fix
- maven de.themoep:inventorygui 1.6.5
- phoenix616 inventorygui 1.6.5
Is CVE-2025-62784 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- last yr.
Exploit prediction
0.22% chance of exploitation in the next 30 days, higher than 13% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N |
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | de.themoep:inventorygui | <1.6.5 |
1.6.5 |
Affected products
- Phoenix616 InventoryGui
Classification
- Weakness
-
- CWE-837 Improper Enforcement of a Single, Unique Action
References
-
github.com
/Phoenix616/InventoryGui/commit/690fc91d137c6cc04f6ed3a89449050964dd8cb9
web, patch
-
github.com
/Phoenix616/InventoryGui/security/advisories/GHSA-7whh-79j3-7c55
web, patch, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-62784
advisory
-
github.com
/Phoenix616/InventoryGui
package
Sources
- CVE List CVE-2025-62784
- GitHub Advisory GHSA-7whh-79j3-7c55
- NVD CVE-2025-62784
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.