CVE-2026-62672 getgrav CVE debrief

Who should care

Site administrators and developers using Grav should assess exposure and update to version 2.0.4 or later. This vulnerability impacts site performance and availability, requiring verification of Grav version and exposure. Operators and security teams should review and update Grav installations to prevent denial of service via a specially crafted regex pattern.

Why it matters

CVE-2026-62672 allows authenticated page editors to cause denial of service via a specially crafted regex pattern in Grav prior to 2.0.4. Site administrators and developers should assess exposure and update to version 2.0.4 or later.

• Denial of service to site visitors due to excessive CPU consumption.
• Potential impact on site performance and availability.
• Need for verification of Grav version and exposure.

Technical summary

Grav allowslist the regex_replace filter and function in system/config/security.yaml. An authenticated page editor can publish a catastrophically backtracking pattern that consumes PHP worker CPU and denies service to site visitors. The issue is fixed in Grav version 2.0.4. This vulnerability impacts site performance and availability, requiring verification of Grav version and exposure. Site administrators and developers should assess exposure and update to version 2.0.4 or later. The CVE record and NVD entry provide details on the vulnerability.

Defensive priority

Authenticated page editors can cause denial of service via a specially crafted regex pattern.

Recommended defensive actions

• Review and update Grav installations to version 2.0.4 or later.
• Restrict access to authenticated page editors.
• Monitor for suspicious regex patterns.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• technicalSummary

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. The issue is fixed in Grav version 2.0.4. Evidence is limited; defenders should verify Grav installations and assess exposure. The regex_replace filter and function in system/config/security.yaml allowlist a potentially vulnerable feature. Site administrators should review and update Grav installations to version 2.0.4 or later.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.