CVE-2026-62237

Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.4

Description A regular expression denial of service (ReDoS) exists in the regex replace filter and function, which are allowlisted in the Twig content sandbox. When Twig processing in page content is enabled via the security.twig content.process enabled variable, an authenticated page editor can provide a catastrophically backtracking PCRE pattern. This pattern is passed to the PHP preg replace() function, leading to unbounded CPU consumption and a denial of service for the web server process.

Recommendations Update Grav to version 2.0.4 or later. Disable Twig processing in page content by setting security.twig content.process enabled to false.