Is there a patch available for CVE-2026-62237?

Yes, a patch is available for CVE-2026-62237. Update the affected software to the latest version immediately.

Grav CMS CVE-2026-62237

Q: What is the CVSS score of CVE-2026-62237?

CVE-2026-62237 has a CVSS 4.0 base score of 6.0 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-45083 MEDIUM

Inefficient Regular Expression Complexity (ReDoS) (CWE-1333)

2026-07-17 VulnCheck

GHSA-6gqg-9qjp-56jm

Denial Of Service Grav Getgrav

6.0

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

6.0 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network vector with low-privilege authentication required; no confidentiality or integrity impact; high availability impact via CPU exhaustion of the web worker process.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 17, 2026 - 02:32 EUVD

Analysis Generated

Jul 17, 2026 - 01:01 vuln.today

DescriptionCVE.org

Grav before 2.0.4 contains a regular expression denial of service (ReDoS) vulnerability in the regex_replace filter and function, which are allowlisted in the Twig content sandbox. When Twig processing in page content is enabled (security.twig_content.process_enabled: true, disabled by default), an authenticated page editor can supply a catastrophically backtracking PCRE pattern that is passed directly to PHP's preg_replace(), causing unbounded CPU consumption and denial of service to the web server process.

AnalysisAI

ReDoS in Grav CMS's Twig sandbox allows an authenticated page editor to crash the web server process via a catastrophically backtracking PCRE pattern supplied to the regex_replace filter. Affected versions are all Grav releases prior to 2.0.4. Exploitation requires a non-default configuration (security.twig_content.process_enabled: true) and at least page-editor-level authentication, limiting blast radius to deployments that have deliberately unlocked Twig processing in page content. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Grav (CPE: cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:*) is a PHP-based flat-file CMS that uses Twig as its templating engine. The vulnerability stems from CWE-1333 (Inefficient Regular Expression Complexity): the regex_replace Twig filter and function are allowlisted inside Grav's Twig content sandbox and pass user-controlled PCRE patterns directly to PHP's native preg_replace(). PHP's PCRE engine uses recursive backtracking that, when given a pattern with ambiguous quantifiers on overlapping character classes, can degrade to exponential time complexity - consuming all available CPU before returning a result. Because preg_replace() executes synchronously within the PHP web worker process, a single crafted request is sufficient to block that worker indefinitely, effectively removing it from the server pool.

RemediationAI

The primary fix is to upgrade Grav to version 2.0.4 or later, as confirmed by the vendor security advisory at https://github.com/getgrav/grav/security/advisories/GHSA-37f3-6p89-6qr9. If an immediate upgrade is not possible, the most effective compensating control is to ensure security.twig_content.process_enabled remains set to false (its default value) in the Grav configuration - this completely blocks the attack path by preventing user-supplied content from being processed as Twig templates. The trade-off is that any legitimate Twig templating in page content will cease to function. Additionally, administrators should audit whether any page-editor-role accounts belong to untrusted or external users, and if so, consider demoting them until the patch is applied. There is no known way to safely permit process_enabled: true without patching, since the underlying PCRE passthrough is the root cause.