PT-2025-44044 · Unknown · Inventorygui

Published 2025-10-27 · Updated 2025-11-04 · CVE-2025-62782

Positive Technologies (AI Summary)

CVSS v4.0

5.9

Medium

Base vector

AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:H/VA:L/SC:N/SI:L/SA:L

Name of the Vulnerable Software and Affected Versions InventoryGui versions 1.6.3-SNAPSHOT and earlier

Description InventoryGui, a library for creating chest GUIs for Bukkit/Spigot plugins, contains an issue where GUIs utilizing GuiStorageElement may allow item duplication when the experimental Bundle item feature is enabled on the server. The issue impacts any plugin using the GuiStorageElement when used on a server with the Bundle items experiment enabled.

Recommendations Update to version 1.6.4-SNAPSHOT. Disable the experimental Bundle items feature on the server. Avoid using the GuiStorageElement in GUIs.

Exploit

Fix

Weakness Enumeration

CWE-837

Related Identifiers

CVE-2025-62782

GHSA-RGVH-4M82-FVJQ

Affected Products

Inventorygui

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62782.json · Exploit
• https://github.com/Phoenix616/InventoryGui/commit/00e684bd689ebc60bcb5b83ce4ef3c5a01778494 · Patch
• https://github.com/Phoenix616/InventoryGui/security/advisories/GHSA-rgvh-4m82-fvjq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62782 · Security Note
• https://osv.dev/vulnerability/CVE-2025-62782 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rgvh-4m82-fvjq · Vendor Advisory
• https://github.com/Phoenix616/InventoryGui/issues/51 · Note
• https://github.com/Phoenix616/InventoryGui · Note
• https://reddit.com/r/VulnMatter/comments/1oibp2u/resumen_diario_de_vulnerabilidades_28102025 · Reddit Post
• https://t.me/cveNotify/141540 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1983041522489516168 · Twitter Post