CVE-2026-62672
Received Received - Intake

Grav Platform Regex Replacement DoS via Backtracking

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description
Grav is a file-based Web platform. Prior to 2.0.4, Grav allowlists the regex_replace filter and function in system/config/security.yaml, and GravExtension::regexReplace() passes an editor-controlled pattern directly to preg_replace(). When security.twig_content.process_enabled is enabled, an authenticated page editor can publish a catastrophically backtracking pattern that consumes PHP worker CPU and denies service to site visitors. This issue is fixed in version 2.0.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-62672
EUVD
EUVD-2026-62542

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
getgrav grav to 2.0.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1333 The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-62672 is an authenticated Regular Expression Denial of Service (ReDoS) vulnerability in Grav, a file-based web platform. The flaw exists in the Twig sandbox environment where the regex_replace filter and function are allowlisted. When Twig content processing is enabled, authenticated page editors can exploit this by supplying a malicious PCRE pattern designed to cause catastrophic backtracking in PHP's preg_replace() function. This leads to unbounded CPU consumption, rendering the web server unresponsive.

Detection Guidance

To detect this vulnerability, check if your Grav CMS version is below 2.0.4. Run: grep -r "version" /path/to/grav/system/version.yaml. If the version is less than 2.0.4, the system is vulnerable. Also verify if Twig content processing is enabled by checking security.twig_content.process_enabled in system/config/security.yaml.

Impact Analysis

This vulnerability can cause complete service denial on single-worker PHP setups or resource exhaustion on multi-worker configurations. It allows authenticated attackers with page edit access to consume excessive CPU resources, making the web server unresponsive and denying service to legitimate users.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR or HIPAA by enabling denial-of-service attacks that disrupt service availability. GDPR requires data processing systems to maintain availability, while HIPAA mandates access controls and system integrity. A successful ReDoS attack could violate these requirements by making systems unavailable or causing resource exhaustion.

Mitigation Strategies

Immediately update Grav CMS to version 2.0.4 or later. Disable Twig content processing if not required by setting security.twig_content.process_enabled to false in system/config/security.yaml. Monitor server CPU usage for unusual spikes indicating potential exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62672. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart