CVE-2026-62672 in Grav
Summary
by MITRE • 08/19/2026
Grav is a file-based Web platform. Prior to 2.0.4, Grav allowlists the regex_replace filter and function in system/config/security.yaml, and GravExtension::regexReplace() passes an editor-controlled pattern directly to preg_replace(). When security.twig_content.process_enabled is enabled, an authenticated page editor can publish a catastrophically backtracking pattern that consumes PHP worker CPU and denies service to site visitors. This issue is fixed in version 2.0.4.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/19/2026
Grav is a file-based content management system designed for speed and simplicity, relying on YAML configuration files rather than a traditional database. The vulnerability described pertains specifically to the handling of regular expression replacements within its Twig templating engine integration. In versions prior to 2.0.4, the Grav platform includes an allowlist mechanism in the system/config/security.yaml file that permits certain filters and functions, including regex_replace. While this approach aims to restrict arbitrary code execution by limiting available template functions, it inadvertently creates a pathway for denial of service attacks if specific conditions are met. The core technical flaw lies within the GravExtension::regexReplace() method, which accepts an editor-controlled pattern string and passes it directly to PHP’s native preg_replace function without sufficient validation or complexity analysis.
The operational impact of this vulnerability is significant when the security.twig_content.process_enabled setting is enabled in the configuration. This setting allows Twig templates embedded within page content to be processed dynamically. An authenticated user with page editing privileges can exploit this by publishing a webpage containing a crafted regular expression pattern designed to cause catastrophic backtracking. Catastrophic backtracking occurs when a regex engine encounters input that causes it to explore an exponential number of possible paths before determining that no match exists or finding the correct one. By carefully constructing such patterns, an attacker can force the PHP worker process to consume excessive CPU resources for extended periods. This effectively results in a denial of service condition, as the server becomes unresponsive to legitimate site visitors due to resource exhaustion caused by the malicious regex execution.
This vulnerability aligns with CWE-400, which describes Uncontrolled Resource Consumption, specifically focusing on how improper handling of input can lead to excessive CPU or memory usage. Furthermore, from a threat modeling perspective using the MITRE ATT&CK framework, this behavior is consistent with techniques related to resource exhaustion and denial of service attacks, where an adversary leverages application logic flaws to degrade system availability rather than compromising confidentiality or integrity directly. The attack vector requires authentication, classifying it as an insider threat scenario or an exploitation by a compromised low-privilege account, which underscores the importance of strict input validation even for authenticated users within content management systems.
To mitigate this vulnerability, organizations running Grav versions prior to 2.0.4 must upgrade immediately to version 2.0.4 or later, where the issue has been resolved through improved handling of regex patterns and potentially stricter validation logic in the extension methods. For environments that cannot be upgraded instantly, administrators should consider disabling the security.twig_content.process_enabled setting if dynamic processing of Twig content within page bodies is not strictly required. Additionally, implementing a Web Application Firewall with rules capable of detecting anomalous CPU usage or specific regex-based attack signatures can provide an additional layer of defense against such exploitation attempts until the patch is applied.