CVE-2026-62237 is a ReDoS vulnerability affecting Grav CMS before version 2.0.4. It exists in the regex_replace filter and function, which are allowlisted in the Twig content sandbox. When the configuration security.twig_content.process_enabled is set to true, an authenticated page editor can provide a malicious regular expression pattern that triggers catastrophic backtracking in PHP's preg_replace(), leading to unbounded CPU consumption and denial of service of the web server process. The vulnerability requires authentication and explicit enabling of Twig processing in page content.

An authenticated page editor can cause denial of service by supplying a crafted regular expression that consumes excessive CPU resources during Twig content processing. This results in unavailability of the web server process hosting Grav. The vulnerability does not allow privilege escalation or data disclosure but impacts service availability. The default configuration disables Twig processing, so exposure is limited unless the feature is enabled.

Upgrade Grav to version 2.0.4 or later where this vulnerability is fixed. If upgrading is not immediately possible, ensure that the configuration setting security.twig_content.process_enabled remains set to false (the default) to prevent exploitation. Since no official patch or temporary fix details are provided, monitoring vendor advisories for updates is recommended.