Executive brief
Grav is a flat-file CMS that supports dynamic Twig templating in page content. When Twig processing is enabled in page content, authenticated page editors can inject a malicious regular expression pattern that causes catastrophic backtracking in PHP's PCRE engine, consuming 100% CPU and making the website unresponsive to all visitors. Single-worker PHP setups experience complete outage; multi-worker deployments can be saturated by multiple concurrent malicious page renders.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) in Grav's Twig sandbox. The `regex_replace` filter and function are allowlisted in `system/config/security.yaml` for use within sandboxed Twig content. The underlying implementation in `GravExtension.php` passes user-controlled regex patterns directly to PHP's `preg_replace()` without validating pattern complexity. When `security.twig_content.process_enabled: true` is set (disabled by default in fresh 2.0 installs but available as an opt-in), an authenticated editor with page-edit access can embed a catastrophically backtracking pattern such as `/^(a+)+$/` in page content with `process: { twig: true }`. This causes the PCRE engine to enter exponential time complexity, exhausting a CPU core for seconds to minutes on modest hardware. The attack requires valid authentication but only the contributor/editor role; it does not require administrator privileges or user interaction beyond page publication. Patch available in version 2.0.4.
Affected products
- Grav Grav CMS < 2.0.4
Timeline
- 2026-09-02: disclosed
- 2026-09-02: patched: Version 2.0.4 released with fix
- 2026-06-29: other: GitHub Advisory published
References
- https://api.github.com/users/gemstone-source
- https://github.com/gemstone-source
- https://api.github.com/users/gemstone-source/gists%7B/gist_id%7D
- https://api.github.com/users/gemstone-source/repos
- https://avatars.githubusercontent.com/u/83114922?v=4
- https://api.github.com/users/gemstone-source/events%7B/privacy%7D