CVE-2026-62237: Grav CMS Regular Expression DoS Vulnerability

CVE-2026-62237 Overview

CVE-2026-62237 is a regular expression denial of service (ReDoS) vulnerability in Grav flat-file CMS versions before 2.0.4. The flaw resides in the regex_replace filter and function, which are allowlisted in the Twig content sandbox. When Twig processing in page content is enabled through security.twig_content.process_enabled: true, an authenticated page editor can submit a catastrophically backtracking PCRE pattern. Grav passes the pattern directly to PHP's preg_replace(), causing unbounded CPU consumption and denial of service to the web server process. The setting is disabled by default, which limits exposure to instances that explicitly opt in.

Critical Impact
An authenticated editor can exhaust CPU resources on the Grav web server process using a crafted PCRE pattern, disrupting site availability.

Affected Products

Grav CMS versions prior to 2.0.4
Grav instances with security.twig_content.process_enabled set to true
Any Grav deployment allowing authenticated page editing with Twig content processing enabled

Discovery Timeline

2026-07-17 - CVE-2026-62237 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-62237

Vulnerability Analysis

The vulnerability is classified under [CWE-1333] Inefficient Regular Expression Complexity. Grav exposes the regex_replace Twig filter and function inside its content sandbox, treating them as safe primitives for text transformation. The sandbox restricts many functions but does not validate or constrain the regular expression patterns that editors supply.

When security.twig_content.process_enabled is set to true, Grav evaluates Twig expressions embedded in page content. An authenticated editor can inject a Twig expression that invokes regex_replace with an attacker-controlled pattern and input. The pattern is passed directly to PHP's preg_replace(), which uses the PCRE engine.

Catastrophic backtracking occurs when a pattern contains nested quantifiers or overlapping alternations against a crafted input string. The PCRE engine explores an exponential number of match paths, consuming CPU cycles until the PHP pcre.backtrack_limit is reached or the request times out. During this window, the web server worker handling the request is unavailable to serve other traffic.

Root Cause

The root cause is missing input validation on regular expression patterns inside a partially trusted sandbox. The Twig content sandbox allowlists regex_replace without imposing pattern complexity limits, execution timeouts, or a safe regex evaluator. Authenticated editors are treated as sufficiently trusted to write Twig, yet the primitive they receive allows unbounded computation on the server.

Attack Vector

An authenticated user with page-editing privileges creates or edits a page containing a Twig expression such as a call to regex_replace with a known catastrophic pattern like /^(a+)+$/ applied to a long non-matching input. Rendering the page triggers preg_replace() execution, pinning a PHP-FPM or Apache worker at 100% CPU. Repeating the request across multiple workers exhausts the server's request handling capacity.

The vulnerability requires authentication and depends on a non-default configuration, which reduces the practical attack surface. Exploitation does not require user interaction beyond page rendering.

Refer to the GitHub Security Advisory GHSA-37f3-6p89-6qr9 and the VulnCheck Advisory on Grav ReDoS for additional technical detail.

Detection Methods for CVE-2026-62237

Indicators of Compromise

PHP-FPM or Apache worker processes sustaining high CPU usage tied to Grav page rendering requests
Twig expressions in page content that call regex_replace with nested quantifier patterns such as (a+)+, (.*)*, or (a|a)*
HTTP 502, 504, or client timeouts correlated with edits to specific Grav pages
PHP error log entries referencing PREG_BACKTRACK_LIMIT_ERROR from preg_replace() calls

Detection Strategies

Audit Grav configuration for security.twig_content.process_enabled: true and enumerate accounts with page-editing privileges
Scan page content and Markdown sources for Twig invocations of regex_replace and inspect the patterns supplied
Monitor PHP process CPU time per request and alert on outliers rendering Grav routes
Review Grav admin audit logs for recent page edits that introduce Twig expressions

Monitoring Recommendations

Instrument the web tier with per-request CPU and wall-clock metrics to surface ReDoS-style long tails
Forward PHP and web server logs to a centralized analytics platform for correlation with editor account activity
Set alerts on repeated pcre.backtrack_limit errors originating from the Grav application

How to Mitigate CVE-2026-62237

Immediate Actions Required

Upgrade Grav to version 2.0.4 or later on all instances
If upgrading is not immediately possible, set security.twig_content.process_enabled to false in system.yaml
Review and reduce the set of accounts with page-editing privileges to trusted operators only
Rotate credentials for editor accounts if unauthorized page edits are suspected

Patch Information

The vendor addressed the vulnerability in Grav 2.0.4. Details are documented in the GitHub Security Advisory GHSA-37f3-6p89-6qr9. Apply the update through the standard Grav upgrade procedure and verify the installed version afterward.

Workarounds

Disable Twig processing in page content by ensuring security.twig_content.process_enabled: false in system.yaml — this is the default setting
Lower PHP's pcre.backtrack_limit and enforce a strict max_execution_time to bound worst-case regex evaluation
Place the Grav admin interface behind network access controls or VPN to restrict editor access
Enable web server request timeouts and per-worker CPU limits to contain runaway preg_replace() executions

bash

# Configuration example - system.yaml
security:
  twig_content:
    process_enabled: false

# php.ini hardening
pcre.backtrack_limit = 100000
max_execution_time = 10