GHSA-37f3-6p89-6qr9
Suggest an improvement- Source
- https://github.com/advisories/GHSA-37f3-6p89-6qr9
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-37f3-6p89-6qr9/GHSA-37f3-6p89-6qr9.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-37f3-6p89-6qr9
- Aliases
- Published
- 2026-09-02T14:50:57Z
- Modified
- 2026-09-17T16:45:06Z
- Severity
-
- 6.0 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Grav: Authenticated ReDoS via regex_replace in Twig Sandbox
- Details
-
Summary
The
regex_replacefilter and function are allowlisted in Grav's Twig content sandbox. When Twig processing in page content is enabledsecurity.twig_content.process_enabled: true, authenticated page editors can supply a catastrophically backtracking PCRE pattern, causing unbounded CPU consumption and denying service to the entire web server process.
Details
The Twig sandbox allowlists, defined in
system/config/security.yaml, explicitly includeregex_replacein both the filter and function permission lists:Source:
system/config/security.yamltwig_sandbox: allowed_filters: # ... - regex_replace # user-controlled pattern allowed in sandbox allowed_functions: # ... - regex_replace # sameThe underlying implementation passes the caller-controlled
$patterndirectly into PHP'spreg_replace()without any pattern complexity validation:Source:
system/src/Grav/Common/Twig/Extension/GravExtension.php:1317-1319public function regexReplace($subject, $pattern, $replace, $limit = -1) { return preg_replace($pattern, $replace, $subject, $limit); }When
twig_content.process_enabledistrue, page body content is sandboxed but can use any allowlisted filter. An editor who embeds a catastrophic backtracking pattern causes the PCRE engine to enter exponential time complexity, consuming 100% CPU until the PHP process is killed or the request times out.Conditions required:
security.twig_content.process_enabled: true(opt-in,falseby default on fresh 2.0 installs)security.twig_sandbox.enabled: true(default) - the function is reachable under sandbox- Attacker must have page edit access (authenticated contributor / editor role)
PoC
Configuration prerequisite - enable Twig in content:
# user/config/security.yaml twig_content: process_enabled: truePayload — embed in any Grav page body with
process: { twig: true }in frontmatter:--- title: Test process: twig: true --- {{ 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaab'|regex_replace('/^(a+)+$/', '') }}Or as a function call in a page where the editor has Twig access:
{{ regex_replace('aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaab', '/^(a+)+$/', '') }}Result: The PHP-FPM worker (or CLI server process) enters catastrophic PCRE backtracking. On a 2 GHz host, a 32-character string with the above pattern will exhaust one CPU core for seconds to minutes. With a slightly longer string, the time grows exponentially.
Impact
Vulnerability type: Regular Expression Denial of Service - ReDoS
Who is impacted: Server availability. Any Grav installation where:
- An editor-role account exists (or has been compromised), AND
- The operator has enabled
twig_content.process_enabled: true
An attacker with page-edit access can render the site unresponsive for all visitors by publishing a page with a catastrophic regex. On single-worker PHP configurations this is a complete outage. On multi-worker setups, multiple concurrent page renders of the malicious page can saturate all workers.
- Database specific
{ "cwe_ids": [ "CWE-1333" ], "github_reviewed": true, "github_reviewed_at": "2026-09-02T14:50:57Z", "nvd_published_at": "2026-08-19T16:18:20Z", "severity": "MODERATE" }- References
Affected packages
Packagist / getgrav/grav
Package
- Name
- getgrav/grav
- Purl
- pkg:composer/getgrav/grav
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed2.0.4