fkie_cve-2026-62672

Grav is a file-based Web platform. Prior to 2.0.4, Grav allowlists the regex_replace filter and function in system/config/security.yaml, and GravExtension::regexReplace() passes an editor-controlled pattern directly to preg_replace(). When security.twig_content.process_enabled is enabled, an authenticated page editor can publish a catastrophically backtracking pattern that consumes PHP worker CPU and denies service to site visitors. This issue is fixed in version 2.0.4.

GHSA-37f3-6p89-6qr9 — Grav: Authenticated ReDoS via regex_replace in Twig Sandbox

Affected: Packagist: getgrav/grav

### Summary

The `regex_replace` filter and function are allowlisted in Grav's Twig content sandbox. When Twig processing in page content is enabled `security.twig_content.process_enabled: true`, authenticated page editors can supply a catastrophically backtracking PCRE pattern, causing unbounded CPU consumption and denying service to the entire web server process.

---

### Details

The Twig sandbox allowlists, defined in `system/config/security.yaml`, explicitly include `regex_replace` in both the filter and function permission lists:

**Source: `system/config/security.yaml`**

```yaml twig_sandbox: allowed_filters: # ... - regex_replace # user-controlled pattern allowed in sandbox allowed_functions: # ... - regex_replace # same ```

The underlying implementation passes the caller-controlled `$pattern` directly into PHP's `preg_replace()` without any pattern complexity validation:

**Source: `system/src/Grav/Common/Twig/Extension/GravExtension.php:1317-1319`**

```php public function regexReplace($subject, $pattern, $replace, $limit = -1) { return preg_replace($pattern, $replace, $subject, $limit); } ```

When `twig_content.process_enabled` is `true`, page body content is sandboxed but can use any allowlisted filter. An editor who embeds a catastrophic backtracking pattern causes the PCRE engine to enter exponential time complexity, consuming 100% CPU until the PHP process is killed or the request times out.

**Conditions required**: 1. `sec…

Most recent entries from all

fkie_cve-2026-62672

GHSA-37f3-6p89-6qr9 — Grav: Authenticated ReDoS via regex_replace in Twig Sandbox