InventoryGui CVE-2025-62782

Two concrete conditions must both hold: (1) the server operator has enabled the currently experimental Minecraft 'Bundle' items feature, and (2) a plugin on that server builds a GUI using InventoryGui's GuiStorageElement. The attacker must be an authenticated player on the server and must actively interact with that GUI (right-click involving a bundle item). Limiting factors: the bundle feature is experimental and off by default, exploitation requires an in-game authenticated player rather than a remote unauthenticated attacker, and only plugins using GuiStorageElement are affected - operators can fully mitigate by disabling the bundle experiment or avoiding GuiStorageElement.

This is a genuine but modest-priority issue, not a critical one. The CVSS 4.0 base score is 5.9 (Medium), and the vector (AV:N/AC:L/AT:P/PR:L/UI:P) shows the integrity impact is real (VI:H) but gated behind an attack requirement (AT:P), low privileges (PR:L - an authenticated player), and user interaction. Confidentiality impact is explicitly none (VC:N), so this is purely an integrity/economy problem (item duplication), consistent with CWE-837 (improper enforcement of a single unique action). Corroborating signals point the same direction: EPSS is low at 0.26% (16th percentile), there is no CISA KEV listing, and no public exploit code was identified - only the patch commit, GHSA advisory, and issue thread. The signals are internally consistent (low likelihood, bounded impact, non-default precondition), with no sharp conflicts. The one caveat worth noting: the AT:P metric and the advisory both make clear exploitation depends on the server operator enabling the experimental 'Bundle' items feature, which materially narrows the exploitable population below what AV:N alone might suggest.

On a Minecraft server running a plugin that uses InventoryGui's GuiStorageElement and has the experimental 'Bundle' item feature enabled, an ordinary authenticated player opens the plugin's chest GUI and right-clicks using a bundle item to trigger the flawed click handling, causing items to be duplicated into their inventory. No public exploit code was identified at time of analysis; the attack is low-complexity but requires the non-default bundle feature to be active.