---
id: "CVE-2017-20288"
kind: "vulnerability"
aliases: ["CVE-2017-20288"]
title: "QCubed PHP framework: reflected XSS via installer step_2 parameter"
severity: "medium"
cvss: 6.1
epss: 0.00256
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "php", "qcubed", "self-hosted"]
not_affected_if: ["default-config", "not-qcubed"]
published_at: "2026-10-22T11:17:02+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T04:03:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-20288", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2017-20288", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# QCubed PHP framework: reflected XSS via installer step_2 parameter

QCubed 2.2.0 through 3.1.1 echoes the installation_path parameter unescaped on its installer page /assets/php/_devtools/installer/step_2.php. An attacker who lures a victim to a crafted GET link can run JavaScript in the victim's browser.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look for the file `assets/php/_devtools/installer/step_2.php` in the QCubed install tree
- Check the installed QCubed version against the affected range 2.2.0 through 3.1.1
- Review web server access logs for GET requests to `/assets/php/_devtools/installer/step_2.php` with `installation_path` values containing script or HTML

## Fix

- Upgrade QCubed to a version later than `3.1.1`, or remove the `_devtools/installer` directory from production
- unknown whether a specific fixed version is named in the sources

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2017-20288
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2017-20288

## From the sources

QCubed 2.2.0 through 3.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the installation_path parameter. Attackers can craft GET requests to /assets/php/_devtools/installer/step_2.php with malicious installation_path values echoed unescaped, executing JavaScript in victims' browsers. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_