{"id":"CVE-2026-62672","title":"Grav is a file-based Web platform","summary":"Grav is a file-based Web platform. Prior to 2.0.4, Grav allowlists the regex_replace filter and function in system/config/security.yaml, and GravExtension::regexReplace() passes an editor-controlled pattern directly to preg_replace(). Wh…","severity":"medium","cvss":6,"cvssVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","cwe":["CWE-1333"],"vendor":"getgrav","product":"grav","affected":["grav < 2.0.4"],"published":"2026-08-19","updated":"2026-09-09","sourceUpdated":"2026-09-09T21:13:25.910","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-62672","references":[{"url":"https://github.com/getgrav/grav/commit/907116268ad4f48be7472c57f64981918578599a","label":"security-advisories@github.com"},{"url":"https://github.com/getgrav/grav/releases/tag/2.0.4","label":"security-advisories@github.com"},{"url":"https://github.com/getgrav/grav/security/advisories/GHSA-37f3-6p89-6qr9","label":"security-advisories@github.com"},{"url":"https://github.com/getgrav/grav/security/advisories/GHSA-37f3-6p89-6qr9","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62672"},{"url":"https://github.com/advisories/GHSA-37f3-6p89-6qr9"}],"tags":["nvd","cve.org","exploit-available","ghsa","composer"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-08-19T18:00:33.930663Z"},"cvssSource":"cna","ingestedAt":"2026-09-12T15:50:22.697Z","epss":0.00387,"epssPercentile":0.32684,"aliases":["GHSA-37f3-6p89-6qr9"],"ecosystem":"composer","patched":["getgrav/grav 2.0.4"],"slug":"CVE-2026-62672","body":"## Overview\n\nGrav is a file-based Web platform. Prior to 2.0.4, Grav allowlists the regex_replace filter and function in system/config/security.yaml, and GravExtension::regexReplace() passes an editor-controlled pattern directly to preg_replace(). When security.twig_content.process_enabled is enabled, an authenticated page editor can publish a catastrophically backtracking pattern that consumes PHP worker CPU and denies service to site visitors. This issue is fixed in version 2.0.4.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-62672)\n\nAffected packages:\n\n- `getgrav/grav < 2.0.4`\n\nPatched in:\n\n- `getgrav/grav 2.0.4`\n\nSource: https://github.com/advisories/GHSA-37f3-6p89-6qr9","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":33,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[]}