CVE-2026-62672

Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.4

Description Grav allows the regex replace filter and function in system/config/security.yaml. The GravExtension::regexReplace() function passes a pattern controlled by the editor directly to preg replace(). When security.twig content.process enabled is enabled, an authenticated page editor can publish a pattern that causes catastrophic backtracking, which consumes PHP worker CPU and results in a denial of service for site visitors. Catastrophic backtracking occurs when a regular expression engine takes an exponential amount of time to determine that a string does not match a pattern.

Recommendations Update to version 2.0.4.