medium5.3
CVE-2025-62784
InventoryGui allows item duplication in GUIs which use GuiStorageElement
Impact
### Impact Any plugin using a GUI with the GuiStorageElement and allows taking out items out of that element. ### Patches InventoryGui 1.6.5 (included in latest 1.6.5-SNAPSHOT) by disabling GuiStorageElement when not running on 1.21.9 or later. ### Workarounds Not using the GuiStorageElement.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | de.themoep:inventorygui | < 1.6.5 | 1.6.5 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Phoenix616 | Inventorygui | before 1.6.5 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/Phoenix616/InventoryGui/commit/690fc91d137c6cc04f6ed3a89449050964dd8cb9
- https://github.com/Phoenix616/InventoryGui/security/advisories/GHSA-7whh-79j3-7c55
- https://github.com/advisories/GHSA-7whh-79j3-7c55
- https://nvd.nist.gov/vuln/detail/CVE-2025-62784