# CVE-2026-62672: Grav authenticated ReDoS in regex_replace Twig filter

Source: https://junglewise.ai/threats/cve-2026-62672-grav-authenticated-redos-in-regex-replace-twig-filter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-19. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-62672 · Severity: medium · CVSS 6 · Published 2026-08-19

Grav is a flat-file CMS that supports dynamic Twig templating in page content. When Twig processing is enabled in page content, authenticated page editors can inject a malicious regular expression pattern that causes catastrophic backtracking in PHP's PCRE engine, consuming 100% CPU and making the website unresponsive to all visitors. Single-worker PHP setups experience complete outage; multi-worker deployments can be saturated by multiple concurrent malicious page renders.

Technologies: [getgrav/grav (Packagist)](https://junglewise.ai/threats/technologies/getgrav-grav). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-62672 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-62672 being exploited in the wild.

**How severe is CVE-2026-62672?** Medium severity, with a CVSS score of 6, published 19 August 2026.

**Which products and versions are affected?** getgrav/grav (Packagist) < 2.0.4.

**Is there a fix for CVE-2026-62672?** A patch was published on 2026-09-02: Version 2.0.4 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-62672 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-62672?** Check whether you run getgrav/grav (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a Regular Expression Denial of Service (ReDoS) in Grav's Twig sandbox. The `regex_replace` filter and function are allowlisted in `system/config/security.yaml` for use within sandboxed Twig content. The underlying implementation in `GravExtension.php` passes user-controlled regex patterns directly to PHP's `preg_replace()` without validating pattern complexity. When `security.twig_content.process_enabled: true` is set (disabled by default in fresh 2.0 installs but available as an opt-in), an authenticated editor with page-edit access can embed a catastrophically backtracking pattern such as `/^(a+)+$/` in page content with `process: { twig: true }`. This causes the PCRE engine to enter exponential time complexity, exhausting a CPU core for seconds to minutes on modest hardware. The attack requires valid authentication but only the contributor/editor role; it does not require administrator privileges or user interaction beyond page publication. Patch available in version 2.0.4.

## Affected products

- Grav Grav CMS < 2.0.4

## Identifiers

- CVE-2026-62672
- GHSA-37f3-6p89-6qr9

## Timeline

- 2026-09-02: disclosed
- 2026-09-02: patched: Version 2.0.4 released with fix
- 2026-06-29: other: GitHub Advisory published

## References

- [https://api.github.com/users/gemstone-source](https://api.github.com/users/gemstone-source)
- [https://github.com/gemstone-source](https://github.com/gemstone-source)
- [https://api.github.com/users/gemstone-source/gists%7B/gist_id%7D](https://api.github.com/users/gemstone-source/gists%7B/gist_id%7D)
- [https://api.github.com/users/gemstone-source/repos](https://api.github.com/users/gemstone-source/repos)
- [https://avatars.githubusercontent.com/u/83114922?v=4](https://avatars.githubusercontent.com/u/83114922?v=4)
- [https://api.github.com/users/gemstone-source/events%7B/privacy%7D](https://api.github.com/users/gemstone-source/events%7B/privacy%7D)

## Related threats

- [Grav cross-site scripting in Twig sandbox asset methods](https://junglewise.ai/threats/cve-2026-86197-grav-cross-site-scripting-in-twig-sandbox-asset-methods)
- [Grav Twig sandbox config exfiltration via offsetGet and dump filters](https://junglewise.ai/threats/cve-2026-61842-grav-twig-sandbox-config-exfiltration-via-offsetget-and-dump)
- [Grav ZipArchiver decompression bomb via missing extraction limits](https://junglewise.ai/threats/cve-2026-61690-grav-ziparchiver-decompression-bomb-via-missing-extraction-limits)
- [Grav incomplete Twig sandbox denylist information disclosure](https://junglewise.ai/threats/grav-incomplete-twig-sandbox-denylist-information-disclosure-e903bd3b)
- [Grav UserInterface offsetGet/offsetExists Twig sandbox bypass](https://junglewise.ai/threats/grav-userinterface-offsetget-offsetexists-twig-sandbox-bypass-f709468e)