The vulnerability resides in the regex_replace filter and function within Grav, which are allowed in the Twig content sandbox. An authenticated page editor can supply a catastrophic backtracking PCRE pattern that is passed directly to PHP’s preg_replace(), triggering unbounded CPU consumption and a denial of service to the web‑server process. This is a classic regular expression denial of service, identified as CWE‑1333.

Grav versions prior to 2.0.4 are affected. The flaw is exposed only when Twig content processing is enabled (security.twig_content.process_enabled set to true), a setting that is disabled by default. Consequently, only deployments that have turned on Twig processing and allow page editors to submit content are at risk. Administrators running these configurations with user accounts having page‑editing rights are the scope of the vulnerability.

The CVSS score of 6 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation at present. The flaw is not listed in the CISA KEV catalog. The attack requires an authenticated editor with Twig processing enabled; thus the threat is primarily internal. Compromise would result in resource exhaustion and potential service interruption rather than data disclosure or code execution.