getgrav Grav up to 2.0.3 Twig Content Sandbox regex_replace redos

Summaryinfo

A vulnerability, which was classified as problematic, has been found in getgrav Grav up to 2.0.3. This vulnerability affects the function regex_replace of the component Twig Content Sandbox. This manipulation causes redos. This vulnerability appears as CVE-2026-62237. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability has been found in getgrav Grav up to 2.0.3 and classified as problematic. Affected by this vulnerability is the function regex_replace of the component Twig Content Sandbox. The manipulation with an unknown input leads to a redos vulnerability. The CWE definition for the vulnerability is CWE-1333. The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles. As an impact it is known to affect availability. The summary by CVE is:

Grav before 2.0.4 contains a regular expression denial of service (ReDoS) vulnerability in the regex_replace filter and function, which are allowlisted in the Twig content sandbox. When Twig processing in page content is enabled (security.twig_content.process_enabled: true, disabled by default), an authenticated page editor can supply a catastrophically backtracking PCRE pattern that is passed directly to PHP's preg_replace(), causing unbounded CPU consumption and denial of service to the web server process.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-62237 since 07/13/2026. The exploitation appears to be easy. The attack can be launched remotely. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1449.003 according to MITRE ATT&CK.

Upgrading to version 2.0.4 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-45083). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• getgrav

Name

• Grav

Version

• 2.0.0
• 2.0.1
• 2.0.2
• 2.0.3

Website

• Product: https://github.com/getgrav/grav/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion