# CVE-2026-62237: Grav ReDoS in Twig sandbox regex_replace filter

Source: https://junglewise.ai/threats/cve-2026-62237-grav-redos-in-twig-sandbox-regex-replace-filter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-17. Updated: 2026-07-17  
License: CC BY 4.0 with a link back

CVE-2026-62237 · Severity: medium · CVSS 6.5 · Published 2026-07-17

Grav, a popular open-source content management system, is vulnerable to a denial-of-service attack. An authenticated user with permission to edit pages can submit a specially crafted text pattern that forces the server's processor to work indefinitely. This can lead to the entire website becoming unresponsive for all visitors, potentially causing a complete service outage.

Technologies: [Grav](https://junglewise.ai/threats/technologies/grav), [getgrav/grav (Packagist)](https://junglewise.ai/threats/technologies/getgrav-grav). Vendors: [Grav](https://junglewise.ai/threats/vendors/grav), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-62237 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-62237 being exploited in the wild.

**How severe is CVE-2026-62237?** Medium severity, with a CVSS score of 6.5, published 17 July 2026.

**Which products and versions are affected?** Grav before 2.0.4; getgrav/grav (Packagist) ECOSYSTEM:introduced=0,fixed=2.0.4.

**Is there a fix for CVE-2026-62237?** Yes. getgrav/grav (Packagist): upgrade to 2.0.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-62237 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-62237?** Check whether you run Grav or getgrav/grav (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- getgrav/grav (Packagist): upgrade to 2.0.4 or later

  ```sh
  composer require getgrav/grav:^2.0.4
  ```


## Technical details

A Regular Expression Denial of Service (ReDoS) vulnerability exists in Grav's Twig content sandbox due to the allowlisting of the 'regex_replace' filter and function. The underlying implementation in GravExtension.php passes user-supplied patterns directly to PHP's preg_replace() without complexity validation. If 'security.twig_content.process_enabled' is set to true, an authenticated attacker with page-editing privileges can embed a catastrophic backtracking PCRE pattern in page content. This results in exponential time complexity during processing, exhausting CPU resources and causing a denial of service (DoS) for the web server process. The issue is fixed in version 2.0.4.

## Affected products

- getgrav Grav before 2.0.4

## Identifiers

- CVE-2026-62237
- GHSA-37f3-6p89-6qr9

## Timeline

- 2026-06-29: advisory: Initial GitHub security advisory published
- 2026-07-17: disclosed: NVD publication date

## References

- [https://github.com/getgrav/grav/security/advisories/GHSA-37f3-6p89-6qr9](https://github.com/getgrav/grav/security/advisories/GHSA-37f3-6p89-6qr9)
- [https://www.vulncheck.com/advisories/grav-redos-via-regex-replace-in-sandbox](https://www.vulncheck.com/advisories/grav-redos-via-regex-replace-in-sandbox)

## Related threats

- [Grav allowlist bypass in Flex form processing](https://junglewise.ai/threats/cve-2026-116019-grav-2-0-15-before-2-2-13-contains-an-allowlist-bypass)
- [Grav improper access control in FlexDirectory::dynamicFlexField()](https://junglewise.ai/threats/cve-2026-114660-grav-from-2-0-0-before-2-2-5-contains-an-improper-access-control)
- [Grav information disclosure via Twig HTTP Basic credentials](https://junglewise.ai/threats/cve-2026-114657-grav-from-2-0-0-before-2-2-5-contains-an-information-disclosure)
- [Grav image pixel limit bypass allows resource exhaustion](https://junglewise.ai/threats/cve-2026-112782-grav-1-7-53-before-1-7-53-5-and-2-0-0-rc-8-before-2-2-2-contains)
- [Grav information disclosure via nested Git repositories](https://junglewise.ai/threats/cve-2026-109326-grav-before-2-1-7-contains-an-information-disclosure)