CVE-2026-62237 Details
Description
Grav before 2.0.4 contains a regular expression denial of service (ReDoS) vulnerability in the regex_replace filter and function, which are allowlisted in the Twig content sandbox. When Twig processing in page content is enabled (security.twig_content.process_enabled: true, disabled by default), an authenticated page editor can supply a catastrophically backtracking PCRE pattern that is passed directly to PHP's preg_replace(), causing unbounded CPU consumption and denial of service to the web server process.
A regular expression denial-of-service (ReDoS) vulnerability has been identified in Grav versions prior to 2.0.4. The issue resides in the `regex_replace` filter and function, which are allowlisted in the Twig content sandbox. When Twig processing in page content is enabled, an authenticated page editor can introduce a PCRE pattern that causes catastrophic backtracking. This pattern is directly passed to PHP's `preg_replace()`, leading to unbounded CPU consumption and denial of service to the web server process.
Users can update Grav to version 2.0.4 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 17, 2026CISA-ADP
Assessed Jul 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/getgrav/grav/security/advisories/GHSA-37f3-6p89-6qr9 | CISA-ADP | AdvisoryExploitTechnical DescriptionVendor |
| https://github.com/getgrav/grav/security/advisories/GHSA-37f3-6p89-6qr9 | [email protected] | AdvisoryExploitTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/grav-redos-via-regex-replace-in-sandbox | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1333 | Inefficient Regular Expression Complexity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Grav | >= 0, < 2.0.4 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | CVE Modified | CISA-ADP |
| Jul 17, 2026 | New CVE Received | [email protected] |