CVE-2025-62782: InventoryGui Item Duplication Vulnerability in GuiStorageElement
Summary
CVE-2025-62782: Impact Any plugin using the GuiStorageElement is impacted when used on a server which allows the (currently experimental) Bundle items. Affects de.themoep:inventorygui versions < 1.6.4-SNAPSHOT. Fixed in 1.6.4-SNAPSHOT. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
InventoryGui is a plugin designed for managing inventory GUIs in Minecraft servers. It allows server administrators to create custom interfaces for item management, enhancing user experience. However, the plugin is vulnerable when used with the experimental 'Bundle' items, which can lead to item duplication issues when the GuiStorageElement is involved.
Vulnerability Detail
The vulnerability arises from the interaction between the InventoryGui plugin and the experimental 'Bundle' items. When a server allows the use of these Bundle items, any GUI utilizing the GuiStorageElement becomes susceptible to item duplication. This can lead to significant gameplay imbalances and exploitation, as players may duplicate valuable items, undermining the integrity of the game.
How To Fix
Minimum fixed version
1.6.4-SNAPSHOT
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the experimental 'Bundle' items on your server or refrain from using the GuiStorageElement in your GUIs to prevent item duplication until you can apply the patch.
Conclusion
The InventoryGui plugin has a vulnerability that allows item duplication when used with experimental Bundle items in GUIs utilizing the GuiStorageElement. It is crucial to update to the patched version to mitigate this risk. Until then, disabling the experimental feature or avoiding the use of the affected GUI elements can serve as a temporary solution.
See every vulnerability recorded for de.themoep:inventorygui →
FAQ
InventoryGui is a Minecraft plugin that allows server administrators to create custom inventory GUIs for enhanced item management.
Bundle items are an experimental feature in Minecraft that allows players to group multiple items together, but they can cause issues when used with certain plugins.
This vulnerability can lead to item duplication, allowing players to exploit the system by creating multiple copies of valuable items, which disrupts the game's balance.
Yes, updating the InventoryGui plugin to version 1.6.4-SNAPSHOT or later will permanently fix the vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By checking your pom.xml file on the Vulert playground, you can determine if your application is affected by this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for de.themoep:inventorygui.
