CVE-2026-62237: Grav < 2.0.4 ReDoS via regex_replace in Sandbox
Grav before 2.0.4 contains a regular expression denial of service (ReDoS) vulnerability in the regexreplace filter and function, which are allowlisted in the Twig content sandbox. When Twig processing in page content is enabled (security.twigcontent.processenabled: true, disabled by default), an authenticated page editor can supply a catastrophically backtracking PCRE pattern that is passed directly to PHP's pregreplace(), causing unbounded CPU consumption and denial of service to the web server process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Gravto a version that resolves this vulnerability.Fixed in 2.0.4 - Configuration
Disable Twig content processing to prevent user-supplied patterns from reaching the regex_replace filter/function (set security.twig_content.process_enabled to false; it is disabled by default).
Grav Twig content sandbox security.twig_content.process_enabled = false
Event History
Frequently Asked Questions
What is the severity of CVE-2026-62237?
CVE-2026-62237 has a medium severity rating of 6.5.
How do I fix CVE-2026-62237?
To fix CVE-2026-62237, upgrade Grav to version 2.0.4 or later.
What is the impact of CVE-2026-62237?
CVE-2026-62237 allows for a regular expression denial of service (ReDoS) vulnerability, potentially causing server performance issues.
Is CVE-2026-62237 exploitable in all configurations?
CVE-2026-62237 is only exploitable if Twig processing in page content is enabled.
Which version of Grav is affected by CVE-2026-62237?
Grav versions prior to 2.0.4 are affected by CVE-2026-62237.