InventoryGui CVE-2025-62784

Requires a confluence of specific conditions: (1) the server runs a plugin that uses InventoryGui's GuiStorageElement AND that plugin permits taking items out of that element; (2) the experimental Bundle item feature is enabled on the server; and (3) per the patch, a server version prior to Minecraft 1.21.9 (the fix disables GuiStorageElement unless running 1.21.9+ or the forceAllow system property is set). The attacker must be an authenticated in-game player (PR:L) interacting with the affected GUI. Limiting factors: the Bundle feature is experimental/non-default, GuiStorageElement with item-removal is a plugin-specific choice, and the impact is confined to game-economy integrity (item duplication) with no confidentiality or availability effect. Workaround per vendor: do not use GuiStorageElement.

This is a genuine but low-to-moderate priority issue, not a high-impact remote code execution threat. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores 5.3 (medium) and reflects only integrity impact (VI:L/SI:L) with no confidentiality or availability effect (VC:N/VA:N) - consistent with CWE-837 and the described item-duplication (economy-integrity) outcome rather than data theft or server compromise. All signals point the same direction and reinforce low urgency: EPSS is 0.22% (12th percentile), the CVE is NOT in CISA KEV, and no public exploit code is referenced in the provided data. PR:L confirms an authenticated actor (an in-game player) is required, and exploitation further depends on a specific, non-default server state (the experimental Bundle item feature) plus a plugin that both uses GuiStorageElement and permits item removal. The one caveat: the vendor's own fix gates GuiStorageElement behind server version 1.21.9+, implying the vulnerable behavior is tied to pre-1.21.9 handling of bundles - this version nuance is not captured in the CVSS vector and should be confirmed against your deployed Minecraft server version. Net: a real integrity bug worth patching in affected plugin ecosystems, but not a widespread or urgently-exploited threat.

A low-privileged player on a Bukkit/Spigot server that has the experimental Bundle item feature enabled and runs a plugin using InventoryGui's GuiStorageElement (configured to allow taking items out) manipulates the storage GUI with a bundle item to clone items, duplicating in-game assets. No public exploit code is identified in the provided data, and exploitation requires the attacker to already be an authenticated player (PR:L).