Grav injects a user-controlled regular expression pattern into PHP’s preg_replace() function without further sanitization. The regex_replace filter and function are allowed in the system/config/security.yaml file, and the GravExtension::regexReplace() method passes the pattern directly to the regex engine. A malicious editor can craft a catastrophically backtracking pattern that consumes near‑total CPU resources, causing the PHP worker to stall and denying service to all site visitors. The weakness is a regex denial‑of‑service flaw classified as CWE‑1333.

The issue affects all Grav releases prior to version 2.0.4, whenever the security.twig_content.process_enabled flag is true and the regex_replace filter is in the sandbox allowlist. Users who run a vulnerable Grav installation with administrative or page‑editor permissions must upgrade the core to 2.0.4 or later, or otherwise remove or restrict the regex_replace functionality in system/config/security.yaml.

The CVSS score of 6.0 indicates moderate severity. The EPSS score is < 1%, indicating a very low likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an authenticated editor who can publish a Twig template. The attack vector is internal and privileged; the potential impact is full denial of service to all site visitors when the malformed pattern is processed.