CVE Alert: CVE-2026-105222 – alexpechkarev – google

The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certificate verification by default because the bundled config sets ssl_verify_peer to FALSE, which is passed to CURLOPT_SSL_VERIFYPEER. On-path attackers can present any certificate to intercept Google Maps web-service requests, steal the API key from the query string, and tamper with responses.

High-impact but situational: prioritise remediation, while exploitation urgency cannot be confirmed because no KEV, SSVC, PoC or EPSS data is supplied.

A successful interception could expose a Google Maps API key and let an attacker alter data returned to the application. This may enable unauthorised API usage, unexpected costs, or misleading map-related functionality; impact depends on what the application displays or does with those responses.

### Most likely attack path

An attacker must be positioned to intercept the application server’s outbound traffic, a significant practical precondition, but no user action or application privileges are required. The vulnerable package makes requests from the server; the stated scope is unchanged, so direct lateral movement is not indicated, though a stolen key could be abused against the associated service.

### Who is most exposed

Laravel applications using this package for server-side Maps web-service calls are exposed, especially those running in networks where outbound traffic can be intercepted or inspected by untrusted intermediaries.

Review outbound proxy and TLS-inspection logs for unexpected interception or certificate mismatches.

Alert on unusual Maps API key usage, source locations, volume, or quota consumption.

Compare application responses with trusted Maps-service results where feasible.

### Mitigation and prioritisation

Upgrade to a release confirmed to enable certificate verification; verify the effective configuration.

Set peer verification to true and test outbound calls before production rollout.

Restrict outbound access to required service endpoints and use trusted egress paths.

Rotate exposed API keys and review usage; apply appropriate key restrictions.

Use a controlled change window, but expedite deployment given the confidentiality and integrity risks.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.