CVE-2021-30134: php-mod/curl allows Cross-site Scripting

December 26, 2022 (updated April 14, 2025)

php-mod/curl (a wrapper of the PHP cURL extension) before 2.3.2 allows XSS via the post_file_path_upload.php key parameter and the POST data to post_multidimensional.php.

References

github.com/advisories/GHSA-f8p3-q834-q9cj
github.com/php-mod/curl
github.com/php-mod/curl/commit/0bddefe8bbd292065f23dd6e24d2c745c4865cf7
nvd.nist.gov/vuln/detail/CVE-2021-30134
wpscan.com/vulnerability/0b547728-27d2-402e-ae17-90d539344ec7

Code Behaviors & Features

Detect and mitigate CVE-2021-30134 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →