Grav CMS EUVD-2026-62542

Exploitation requires two concrete prerequisites: (1) the attacker must hold an authenticated page-editor account on the target Grav instance - PR:L in the CVSS vector confirms low-privilege authentication is required; (2) the security.twig_content.process_enabled setting must be enabled in system/config/security.yaml, which is a non-default configuration (AT:P in CVSS 4.0 reflects this specific deployment requirement). Exploitation is limited to availability impact only - no confidentiality or integrity compromise is possible through this vector. The attack is further constrained by the need to publish a page that site visitors will load, meaning the attacker must have publish rights in addition to edit rights. Default Grav installations with Twig content processing disabled are not exploitable.

The CVSS 4.0 score of 6.0 with vector AV:N/AC:H/AT:P/PR:L reflects a genuinely constrained attack surface: exploitation requires both authenticated low-privilege editor access and the non-default security.twig_content.process_enabled configuration. The AC:H and AT:P designations are appropriate - the attack is not opportunistic against default installs. EPSS data was not provided; however, given the authentication and configuration prerequisites, widespread automated exploitation is unlikely. No KEV listing is confirmed, and no public proof-of-concept has been identified at time of analysis. Despite the moderate score, the impact on availability is rated High (VA:H) because a single malicious template publication can permanently degrade PHP-FPM worker capacity until the page is removed or the process recycled. The risk is most acute for multi-tenant Grav deployments or sites where editor accounts are broadly assigned - a scenario where the attacker pool expands significantly. Confidentiality and integrity are unaffected. Overall, this is a credible but targeted availability risk: lower priority than network-reachable unauthenticated vulnerabilities, but urgent for any deployment that grants Twig content processing to untrusted editors.

An attacker who holds a low-privilege editor account on a Grav site with security.twig_content.process_enabled active crafts a Twig template containing a regex_replace call with a catastrophically backtracking pattern (e.g., a polynomial or exponential PCRE pattern applied to a sufficiently long input string) and publishes it as a page. When any visitor loads that page, the PHP-FPM worker executing preg_replace() spins to the PCRE backtrack limit, consuming 100% CPU for the duration, degrading or denying service to concurrent users. No public proof-of-concept has been identified at time of analysis, though constructing such a pattern requires only basic knowledge of ReDoS techniques.