InventoryGui CVE-2025-62783

Two concrete conditions must both hold: (1) a Bukkit/Spigot plugin on the server must use InventoryGui's GuiStorageElement to render a chest GUI, and (2) the experimental 'Bundle item' feature must be enabled on the server. Exploitation is limited to authenticated players already connected to the server (PR:L) who interact with the vulnerable GUI; it does not affect default configurations where the experimental Bundle feature is disabled. The vendor workaround is to avoid using GuiStorageElement in GUIs. Impact is confined to in-game item/economy integrity - no server compromise, data disclosure, or denial of service.

This is a genuinely low-priority issue despite the 'high-severity-sounding' item-duplication impact. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3 MEDIUM) is internally consistent: no confidentiality or availability impact, only a low integrity impact reflecting duplicated in-game items. PR:L is accurate because exploitation requires an authenticated player on the server interacting with a plugin GUI. The EPSS score of 0.25% (16th percentile) reinforces low real-world exploitation likelihood. There is NO CISA KEV listing and NO public exploit code identified in the provided data, so there is no evidence of active exploitation. The impact is confined to in-game economy integrity on Minecraft (Bukkit/Spigot) servers - not system compromise, data theft, or availability loss. One cross-source note: the input Tags label this 'Information Disclosure,' which conflicts with both the description (item duplication) and the CVSS vector (C:N, I:L) - the true impact class is integrity/duplication, not confidentiality. No conflicting signals exist between CVSS, EPSS, and the vendor advisory otherwise; all agree this is a low-to-medium, non-critical issue.

A player on a Minecraft server running a plugin that uses InventoryGui's GuiStorageElement - with the experimental Bundle item feature enabled server-side - manipulates items through the chest GUI to duplicate them, inflating their inventory and undermining the server economy. No public exploit code is identified in the provided data, and exploitation requires being a connected, authenticated player interacting with the vulnerable GUI.