Security Advisory

ZF2010-05: Potential XSS vector in Zend_Service_ReCaptcha_MailHide

Executive Summary

Zend_Service_ReCaptcha_MailHide had a potential XSS vulnerability. Due to the fact that the email address was never validated, and because its use of htmlentities() did not include the encoding argument, it was potentially possible for a malicious user aware of the issue to inject a specially crafted multibyte string as an attack via the CAPTCHA's email argument.

Action Taken

An EmailAddress validator was added by default to Zend_Service_ReCaptcha_MailHide (which may be replaced with any Zend_Validate_interface implementation), and the submitted email address is now passed through this validator prior to performing any markup generation. Additionally, accessors for setting and retrieving the encoding to use with htmlentities() have been provided, with a default value of UTF-8 used.


If you use Zend_Service_ReCaptcha_MailHide, it is strongly recommended that you upgrade to either the latest available Zend Framework release, or one of the following releases, immediately:

Other Information


The Zend Framework team thanks the following for working with us to help protect its users:

Reporting Potential Security Issues

If you have encountered a potential security vulnerability in Zend Framework, please report it to us at We will work with you to verify the vulnerability and patch it.

When reporting issues, please provide the following information:

We request that you contact us via the email address above and give the project contributors a chance to resolve the vulnerability and issue a new release prior to any public exposure; this helps protect Zend Framework users and provides them with a chance to upgrade and/or update in order to protect their applications.

For sensitive email communications, please use our PGP key.


Zend Framework takes security seriously. If we verify a reported security vulnerability, our policy is:

Released Mon, 11 Jan 2010 16:00:00 -0500.

back to advisories