N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-62784

CVE-2025-62784: InventoryGui allows item duplication in GUIs which use GuiStorageElement

Impact

Any plugin using a GUI with the GuiStorageElement and allows taking out items out of that element.

Patches

InventoryGui 1.6.5 (included in latest 1.6.5-SNAPSHOT) by disabling GuiStorageElement when not running on 1.21.9 or later.

Workarounds

Not using the GuiStorageElement.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-62784

CVE-2025-62784:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
de.themoep:inventorygui	maven	< 1.6.5	1.6.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in a desynchronization issue between the visual inventory presented to the player and the actual backing inventory storage, specifically when using GuiStorageElement. The analysis of the patch commit 690fc91d137c6cc04f6ed3a89449050964dd8cb9 reveals the root cause and the affected functions.

The core of the vulnerability is in the click and drag handling logic. The original code had several weaknesses:

In the GuiStorageElement constructor, the click handler (setAction) did not adequately verify that the item displayed in the GUI (slotItem) matched the item in the backing storage (storageItem) before performing an action. This allowed a player to get the GUI into an inconsistent state that could be exploited.
The InventoryGui.onInventoryDrag method used an insufficient validation function (validateItemPlace), which could be bypassed to create duplicated items.
A central flawed mechanism was the InventoryGui.storeItems method. This method, called on inventory close or page change, would save the (potentially manipulated) state of the visual GUI back to the storage, making the item duplication permanent. The patch completely removes this method.

The fix involves three main changes:

Adding strict consistency checks in the GuiStorageElement click handler to detect and correct any desynchronization between the visual slot and the backing storage before any click action is processed.
Replacing the weak validation in onInventoryDrag with a direct and safer update to the storage.
Removing the storeItems method entirely, thus eliminating the flawed synchronization trigger.

Therefore, the vulnerable functions are the GuiStorageElement constructor where the faulty click handler is defined, the onInventoryDrag event handler, and the now-removed storeItems method which finalized the duplication.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-62784: InventoryGui allows item duplication in GUIs which use GuiStorageElement

Impact

Patches

Workarounds

CVE-2025-62784:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

CVE-2025-62784: InventoryGui allows item duplication in GUIs which use GuiStorageElement

Impact

Patches

Workarounds

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

N/A

N/A

Basic Information

Basic Information

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI