CVE-2026-62672: Grav: Authenticated ReDoS via regex_replace in Twig Sandbox

September 2, 2026 (updated September 17, 2026)

The regex_replace filter and function are allowlisted in Grav’s Twig content sandbox. When Twig processing in page content is enabled security.twig_content.process_enabled: true, authenticated page editors can supply a catastrophically backtracking PCRE pattern, causing unbounded CPU consumption and denying service to the entire web server process.

References

github.com/advisories/GHSA-37f3-6p89-6qr9
github.com/getgrav/grav/commit/907116268ad4f48be7472c57f64981918578599a
github.com/getgrav/grav/releases/tag/2.0.4
github.com/getgrav/grav/security/advisories/GHSA-37f3-6p89-6qr9
nvd.nist.gov/vuln/detail/CVE-2026-62672

Code Behaviors & Features

Detect and mitigate CVE-2026-62672 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →