CVE-2026-62672: Grav authenticated ReDoS in regex_replace Twig filter

CVE-2026-62672 · Severity: medium · CVSS 6 · Published 2026-08-19

Grav is a flat-file CMS that supports dynamic Twig templating in page content. When Twig processing is enabled in page content, authenticated page editors can inject a malicious regular expression pattern that causes catastrophic backtracking in PHP's PCRE engine, consuming 100% CPU and making the website unresponsive to all visitors. Single-worker PHP setups experience complete outage; multi-worker deployments can be saturated by multiple concurrent malicious page renders.

Technologies: getgrav/grav (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-62672 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-62672 being exploited in the wild.
How severe is CVE-2026-62672?
Medium severity, with a CVSS score of 6, published 19 August 2026.
Which products and versions are affected?
getgrav/grav (Packagist) < 2.0.4.
Is there a fix for CVE-2026-62672?
A patch was published on 2026-09-02: Version 2.0.4 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-62672 attacked?
It is attacked over the network.
Am I affected by CVE-2026-62672?
Check whether you run getgrav/grav (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a Regular Expression Denial of Service (ReDoS) in Grav's Twig sandbox. The `regex_replace` filter and function are allowlisted in `system/config/security.yaml` for use within sandboxed Twig content. The underlying implementation in `GravExtension.php` passes user-controlled regex patterns directly to PHP's `preg_replace()` without validating pattern complexity. When `security.twig_content.process_enabled: true` is set (disabled by default in fresh 2.0 installs but available as an opt-in), an authenticated editor with page-edit access can embed a catastrophically backtracking pattern such as `/^(a+)+$/` in page content with `process: { twig: true }`. This causes the PCRE engine to enter exponential time complexity, exhausting a CPU core for seconds to minutes on modest hardware. The attack requires valid authentication but only the contributor/editor role; it does not require administrator privileges or user interaction beyond page publication. Patch available in version 2.0.4.

Affected products

  • Grav Grav CMS < 2.0.4

Identifiers

  • CVE-2026-62672
  • GHSA-37f3-6p89-6qr9

Timeline

  • 2026-09-02: disclosed
  • 2026-09-02: patched: Version 2.0.4 released with fix
  • 2026-06-29: other: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.