CVE-2026-62672: CWE-1333: Inefficient Regular Expression Complexity in getgrav grav
Grav is a file-based Web platform. Prior to 2.0.4, Grav allowlists the regex_replace filter and function in system/config/security.yaml, and GravExtension::regexReplace() passes an editor-controlled pattern directly to preg_replace(). When security.twig_content.process_enabled is enabled, an authenticated page editor can publish a catastrophically backtracking pattern that consumes PHP worker CPU and denies service to site visitors. This issue is fixed in version 2.0.4.
AI Analysis
Technical Summary
Grav versions before 2.0.4 include a vulnerability (CWE-1333) involving inefficient regular expression complexity. The regex_replace filter and function are allowlisted in system/config/security.yaml, and the GravExtension::regexReplace() method passes an editor-controlled regex pattern directly to PHP's preg_replace(). When the configuration option security.twig_content.process_enabled is enabled, an authenticated page editor can publish a regex pattern that triggers catastrophic backtracking, causing excessive CPU usage and denial of service to site visitors. This vulnerability is addressed in version 2.0.4.
Potential Impact
An authenticated page editor can cause denial of service by publishing a regex pattern that consumes excessive PHP worker CPU resources, resulting in service disruption for site visitors. There is no indication of remote unauthenticated exploitation or data compromise. The impact is limited to denial of service via resource exhaustion.
Mitigation Recommendations
Upgrade Grav to version 2.0.4 or later, where this vulnerability is fixed. No other official remediation or temporary fixes are indicated. Until patched, restrict authenticated page editors from publishing untrusted regex patterns or disable security.twig_content.process_enabled if feasible.
CVE-2026-62672: CWE-1333: Inefficient Regular Expression Complexity in getgrav grav
Description
Grav is a file-based Web platform. Prior to 2.0.4, Grav allowlists the regex_replace filter and function in system/config/security.yaml, and GravExtension::regexReplace() passes an editor-controlled pattern directly to preg_replace(). When security.twig_content.process_enabled is enabled, an authenticated page editor can publish a catastrophically backtracking pattern that consumes PHP worker CPU and denies service to site visitors. This issue is fixed in version 2.0.4.
CVSS v4.0
Score 6.0medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Grav versions before 2.0.4 include a vulnerability (CWE-1333) involving inefficient regular expression complexity. The regex_replace filter and function are allowlisted in system/config/security.yaml, and the GravExtension::regexReplace() method passes an editor-controlled regex pattern directly to PHP's preg_replace(). When the configuration option security.twig_content.process_enabled is enabled, an authenticated page editor can publish a regex pattern that triggers catastrophic backtracking, causing excessive CPU usage and denial of service to site visitors. This vulnerability is addressed in version 2.0.4.
Potential Impact
An authenticated page editor can cause denial of service by publishing a regex pattern that consumes excessive PHP worker CPU resources, resulting in service disruption for site visitors. There is no indication of remote unauthenticated exploitation or data compromise. The impact is limited to denial of service via resource exhaustion.
Mitigation Recommendations
Upgrade Grav to version 2.0.4 or later, where this vulnerability is fixed. No other official remediation or temporary fixes are indicated. Until patched, restrict authenticated page editors from publishing untrusted regex patterns or disable security.twig_content.process_enabled if feasible.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-07-14T20:22:04.394Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a85d17aacd9273b4948b475
Added to database: 08/19/2026, 15:53:30 UTC
Last enriched: 08/19/2026, 16:13:06 UTC
Last updated: 08/19/2026, 18:44:21 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.