13 matches found
GHSA-37F3-6P89-6QR9 Grav: Authenticated ReDoS via regex_replace in Twig Sandbox
Summary The regexreplace filter and function are allowlisted in Grav's Twig content sandbox. When Twig processing in page content is enabled security.twigcontent.processenabled: true, authenticated page editors can supply a catastrophically backtracking PCRE pattern, causing unbounded CPU...
Grav: Authenticated ReDoS via regex_replace in Twig Sandbox
Summary The regexreplace filter and function are allowlisted in Grav's Twig content sandbox. When Twig processing in page content is enabled security.twigcontent.processenabled: true, authenticated page editors can supply a catastrophically backtracking PCRE pattern, causing unbounded CPU...
EUVD-2026-62542
Grav: Authenticated ReDoS via regexreplace in Twig Sandbox...
CVE-2026-62672 Grav: Authenticated ReDoS via regex_replace in Twig Sandbox
Grav is a file-based Web platform. Prior to 2.0.4, Grav allowlists the regexreplace filter and function in system/config/security.yaml, and GravExtension::regexReplace passes an editor-controlled pattern directly to pregreplace. When security.twigcontent.processenabled is enabled, an authenticate...
CVE-2026-62672 Grav: Authenticated ReDoS via regex_replace in Twig Sandbox
Grav is a file-based Web platform. Prior to 2.0.4, Grav allowlists the regexreplace filter and function in system/config/security.yaml, and GravExtension::regexReplace passes an editor-controlled pattern directly to pregreplace. When security.twigcontent.processenabled is enabled, an authenticate...
CVE-2026-62672: Inefficient Regular Expression Complexity
Grav is a file-based Web platform. Prior to 2.0.4, Grav allowlists the regexreplace filter and function in system/config/security.yaml, and GravExtension::regexReplace passes an editor-controlled pattern directly to pregreplace. When security.twigcontent.processenabled is enabled, an authenticate...
CVE-2026-62237: Inefficient Regular Expression Complexity
Grav before 2.0.4 contains a regular expression denial of service ReDoS vulnerability in the regexreplace filter and function, which are allowlisted in the Twig content sandbox. When Twig processing in page content is enabled security.twigcontent.processenabled: true, disabled by default, an...
EUVD-2005-0914
Malware in sbrugna...
CVE-2005-0913
Unknown vulnerability in the regexreplace modifier modifier.regexreplace.php in Smarty before 2.6.8 allows attackers to execute arbitrary PHP code...
CVE-2005-0913
Unknown vulnerability in the regexreplace modifier modifier.regexreplace.php in Smarty before 2.6.8 allows attackers to execute arbitrary PHP code...
GLSA-200503-35 : Smarty: Template vulnerability
The remote host is affected by the vulnerability described in GLSA-200503-35 Smarty: Template vulnerability A vulnerability has been discovered within the regexreplace modifier of the Smarty templates when allowing access to untrusted users. Furthermore, it was possible to call functions from if...
CVE-2005-0913
Smarty vulnerability CVE-2005-0913 affects the regex_replace modifier in Smarty versions before 2.6.8, enabling attackers to execute arbitrary PHP code. The Gentoo GLSA and related open-source advisories describe a remote code execution risk via the template engine’s regex_replace modifier when u...