CVE-2025-62784: InventoryGui Item Duplication Vulnerability

CVE-2025-62784 Overview

CVE-2025-62784 affects InventoryGui, a Java library used by Bukkit/Spigot plugin developers to build chest-based graphical user interfaces in Minecraft servers. Versions before 1.6.5 contain a business logic flaw in the GuiStorageElement handling code. When a server enables the experimental Bundle item feature and a plugin permits players to withdraw items from a GuiStorageElement, players can duplicate items. The maintainer Phoenix616 resolved the issue in version 1.6.5 [CWE-837].

Critical Impact
Authenticated players on servers running vulnerable InventoryGui plugins with the Bundle feature enabled can duplicate in-game items, undermining server economies and integrity.

Affected Products

Phoenix616 InventoryGui versions prior to 1.6.5
Bukkit/Spigot server plugins that embed InventoryGui and expose GuiStorageElement
Minecraft servers running with the experimental Bundle item feature enabled

Discovery Timeline

2025-10-27 - CVE-2025-62784 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-62784

Vulnerability Analysis

InventoryGui provides an abstraction for constructing chest GUIs backed by Bukkit Inventory objects. The GuiStorageElement class allows plugins to expose a backing inventory that players can take items from or put items into. The duplication path arises from the interaction between InventoryGui's page navigation logic, its item storage callbacks, and Minecraft's experimental Bundle item, which itself contains nested item stacks.

When a player interacts with a storage element while a Bundle item is involved, the library's state synchronization writes back item stacks in a way that permits the same stack to be persisted twice. The result is that items withdrawn from the GUI remain available in the backing storage, producing extra copies. This is a classic business logic error rather than a memory or injection defect.

Root Cause

The root cause is a mishandled predictable state transition [CWE-837] between the GUI view and the backing storage when Bundle items are present. In the vulnerable code path, setPageNumber invoked storeItems before redrawing the inventory, which reintroduced item stacks that a player had already taken out. The fix removes the redundant storeItems call inside setPageNumber so that state is not written back at the wrong point in the interaction lifecycle.

Attack Vector

Exploitation requires an authenticated player on a Minecraft server that (1) runs a plugin using GuiStorageElement, (2) permits item withdrawal from that element, and (3) has the experimental Bundle item feature enabled. The player interacts with the GUI using Bundle items to trigger the flawed state synchronization, then withdraws duplicated items. No elevated privileges or code execution are needed.

java

     * @param pageNumber    The page number to set
     */
    public void setPageNumber(HumanEntity player, int pageNumber) {
-        Inventory inventory = getInventory(player);
-        if (inventory != null) {
-            storeItems(player, inventory);
-        }
        setPageNumberInternal(player, pageNumber);
-        draw(player, false, false, false);
+        draw(player, false, false);
    }

    private void setPageNumberInternal(HumanEntity player, int pageNumber) {
// Source: https://github.com/Phoenix616/InventoryGui/commit/690fc91d137c6cc04f6ed3a89449050964dd8cb9

The patch removes the pre-navigation storeItems write-back, which was the point at which duplicated Bundle contents were being reintroduced into the backing inventory.

Detection Methods for CVE-2025-62784

Indicators of Compromise

Sudden increases in high-value item counts held by individual players in server economy databases or scoreboard exports.
Player inventory or chest logs showing repeated withdrawal events from GUI-backed containers without corresponding deposits.
Plugin logs referencing GuiStorageElement interactions immediately followed by Bundle item slot changes.

Detection Strategies

Inventory Bukkit/Spigot server plugin dependencies and flag any bundling de.themoep.inventorygui versions below 1.6.5.
Audit server configuration for the experimental Bundle item feature (enable-experimental-features or datapack equivalents) and correlate with plugins using storage GUIs.
Compare economy or item-log snapshots over time to identify duplication anomalies tied to specific players or GUI plugins.

Monitoring Recommendations

Enable verbose logging in plugins that use InventoryGui and route logs to a centralized log store for retrospective analysis.
Alert on rapid, repeated open-and-close events against the same GUI when Bundle items are in a player's inventory.
Track dependency versions in CI so that plugins shipping InventoryGui < 1.6.5 fail the build.

How to Mitigate CVE-2025-62784

Immediate Actions Required

Upgrade all Bukkit/Spigot plugins that shade or depend on InventoryGui to version 1.6.5 or later.
Disable the experimental Bundle item feature on production Minecraft servers until every dependent plugin is patched.
Restrict player access to GUIs backed by GuiStorageElement where withdrawal is permitted, pending upgrade.

Patch Information

The fix is committed in Phoenix616/InventoryGui commit 690fc91 and released in version 1.6.5. Full details are published in GitHub Security Advisory GHSA-7whh-79j3-7c55. Plugin developers should rebuild and redistribute artifacts that shade InventoryGui, and server operators should replace vulnerable plugin JARs.

Workarounds

Turn off the experimental Bundle feature in server.properties and any datapacks that enable it.
Temporarily modify affected plugins to disallow item extraction from GuiStorageElement instances until they are upgraded.
Roll back player inventories and economy state from backups if duplication is confirmed.

bash

# Verify shaded InventoryGui version inside a plugin JAR
unzip -p plugin.jar META-INF/maven/de.themoep/inventorygui/pom.properties | grep version

# On Paper/Spigot, disable experimental Bundle usage by ensuring
# experimental datapacks are not loaded and the feature flag is off:
# In server.properties keep:
#   enable-experimental-features=false