CVE-2026-62672

UNKNOWN 0.0

Grav: Authenticated ReDoS via regex_replace in Twig Sandbox

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Grav is a file-based Web platform. Prior to 2.0.4, Grav allowlists the regex_replace filter and function in system/config/security.yaml, and GravExtension::regexReplace() passes an editor-controlled pattern directly to preg_replace(). When security.twig_content.process_enabled is enabled, an authenticated page editor can publish a catastrophically backtracking pattern that consumes PHP worker CPU and denies service to site visitors. This issue is fixed in version 2.0.4.

CWE	CWE-1333
Vendor	getgrav
Product	grav
Published	Aug 19, 2026
Last Updated	Aug 19, 2026

Stay Ahead of the Next One

Get instant alerts for getgrav grav

Be the first to know when new unknown vulnerabilities affecting getgrav grav are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

getgrav / grav

< 2.0.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/getgrav/grav/security/advisories/GHSA-37f3-6p89-6qr9 github.com: https://github.com/getgrav/grav/commit/907116268ad4f48be7472c57f64981918578599a github.com: https://github.com/getgrav/grav/releases/tag/2.0.4