GHSA-7whh-79j3-7c55

ghsaUSosv

InventoryGui allows item duplication in GUIs which use GuiStorageElement

view advisory published 2025-10-28Licence: CC-BY-4.0

### Impact Any plugin using a GUI with the GuiStorageElement and allows taking out items out of that element. ### Patches InventoryGui 1.6.5 (included in latest 1.6.5-SNAPSHOT) by disabling GuiStorageElement when not running on 1.21.9 or later. ### Workarounds Not using the GuiStorageElement.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-62784US	medium5.3	0.22% (13th)	—	2025-10-27
InventoryGui is a library for creating chest GUIs for Bukkit/Spigot plugins. Versions before 1.6.5 contain a vulnerability where any plugin using a GUI with the GuiStorageElement a…

references

External citations — patches, advisories, analysis.

https://github.com/Phoenix616/InventoryGuiPACKAGE
https://github.com/Phoenix616/InventoryGui/commit/690fc91d137c6cc04f6ed3a89449050964dd8cb9WEB
https://github.com/Phoenix616/InventoryGui/security/advisories/GHSA-7whh-79j3-7c55WEB
https://nvd.nist.gov/vuln/detail/CVE-2025-62784ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan