alexpechkarev google-maps: Disabled TLS certificate verification in Laravel package
Summary
The alexpechkarev/google-maps Laravel package through version 12.16 ships a configuration that disables TLS certificate verification (ssl_verify_peer set to FALSE). An attacker in an on-path position can present any certificate, intercept Google Maps web-service requests, steal the API key contained in the query string and tamper with the responses. No credentials are required, but the attacker needs a network position between the server and Google.
Affected
- alexpechkarev/google-maps 1.0.3 to 12.16 according to the CNA record
- The CNA record marks the default configuration as unaffected, which conflicts with the bundled config described in the CVE. Verify the effective setting in your installation.
Fixed in
Unknown. No vendor advisory or patched version has been found.
Workaround
- Unknown from the vendor.
- Override the published config so that certificate verification is enabled, and confirm in a test environment that HTTPS calls still succeed.
- Restrict the Google API key by API, IP address or referrer, and rotate it if interception is suspected.
- Set billing and quota alerts on the key.
Exploitation
- A third-party aggregator reports detected exploitation attempts. This could not be confirmed from a primary source.
- EPSS score: 0.19%.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- No public proof of concept was found.
Our recommendation
- Check composer.lock for the installed version and whether the config overrides the default.
- Apply the workaround and enable certificate verification until the maintainer publishes a fix.
- Restrict and monitor the Google Maps API key for unusual usage.
- Re-check GitHub issue #123 and the repository for updates, and consider a fork or replacement if no fix appears.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub repository alexpechkarev/google-maps github.com
- WebService.php at v12.14 github.com
- Default config googlemaps.php at v12.16 github.com
- GitHub issue #123 github.com
- VulnCheck advisory www.vulncheck.com
- OSV entry CVE-2026-105222 osv.dev
- RedPacket Security alert www.redpacketsecurity.com
- GitHub releases alexpechkarev/google-maps github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:33.
Original description (NVD)
The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certificate verification by default because the bundled config sets ssl_verify_peer to FALSE, which is passed to CURLOPT_SSL_VERIFYPEER. On-path attackers can present any certificate to intercept Google Maps web-service requests, steal the API key from the query string, and tamper with responses.
NVD references (5)
- https://github.com/alexpechkarev/google-maps
- https://github.com/alexpechkarev/google-maps/blob/v12.14/src/WebService.php#L267-L269
- https://github.com/alexpechkarev/google-maps/blob/v12.16/src/config/googlemaps.php#L28
- https://github.com/alexpechkarev/google-maps/issues/123
- https://www.vulncheck.com/advisories/alexpechkarev-google-maps-through-12.16-disabled-tls-certificate-verific…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.