Regular Expression Denial of Service in Grav by GetGrav

CVE-2026-62237

What is CVE-2026-62237?

Grav versions prior to 2.0.4 are susceptible to a regular expression denial of service (ReDoS) vulnerability in the regex_replace filter utilized within the Twig content sandbox. When the Twig processing feature is enabled, an authenticated user can exploit this vulnerability by submitting a poorly constructed regex pattern. This can trigger catastrophic backtracking in the pattern matching process, leading to excessive CPU consumption and potentially halting the web server's operations. It is critical for users of Grav to upgrade to version 2.0.4 or later to mitigate this risk effectively.

References