CVE-2026-62237 – Grav < 2.0.4 ReDoS via regex_replace in Sandbox

CVE ID :CVE-2026-62237

Published : July 17, 2026, 2:18 a.m. | 1 hour, 17 minutes ago

Description :Grav before 2.0.4 contains a regular expression denial of service (ReDoS) vulnerability in the regex_replace filter and function, which are allowlisted in the Twig content sandbox. When Twig processing in page content is enabled (security.twig_content.process_enabled: true, disabled by default), an authenticated page editor can supply a catastrophically backtracking PCRE pattern that is passed directly to PHP’s preg_replace(), causing unbounded CPU consumption and denial of service to the web server process.

Severity: 6.5 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…