CVE-2026-62237 describes a ReDoS vulnerability in Grav CMS before version 2.0.4. The issue exists in the regex_replace filter and function, which are allowlisted in the Twig content sandbox. When the configuration option security.twig_content.process_enabled is set to true, an authenticated page editor can supply a malicious PCRE pattern that triggers catastrophic backtracking in PHP's preg_replace(), leading to unbounded CPU usage and denial of service of the web server process. This vulnerability requires authentication and is not exploitable via unauthenticated users. The vulnerability is documented with a CVSS 4.0 score of 6.0 (medium severity). No vendor advisory or patch information is provided in the input.

An authenticated page editor can cause a denial of service on the web server hosting Grav by supplying a crafted regular expression pattern that triggers catastrophic backtracking in PHP's preg_replace() function. This results in excessive CPU consumption, potentially making the web server unresponsive. The vulnerability does not affect confidentiality, integrity, or availability beyond denial of service and requires authentication to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling Twig content processing in page content by ensuring the configuration security.twig_content.process_enabled is set to false (default setting). Restrict authenticated page editor privileges to trusted users only to reduce risk.