Drpr0Grammer

**Name of the Vulnerable Software and Affected Versions** Grav versions prior to 2.0.4 **Description** A regular expression denial of service (ReDoS) exists in the `regex replace` filter and function, which are allowlisted in the Twig content sandbox. When Twig processing in page content is enabled via the `security.twig content.process enabled` variable, an authenticated page editor can provide a catastrophically backtracking PCRE pattern. This pattern is passed to the PHP `preg replace()` function, leading to unbounded CPU consumption and a denial of service for the web server process. **Recommendations** Update Grav to version 2.0.4 or later. Disable Twig processing in page content by setting `security.twig content.process enabled` to false.