Vulnerability · Published Oct 4, 2026 · Assigned by VulnCheck

CVE-2026-105222alexpechkarev/google-maps through 12.16 Disabled TLS Certificate Verification via ssl_verify_peer

High 7.4

In plain English

A high-severity improper certificate validation in google-maps from alexpechkarev. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)7.4High

Exploit odds (30 days)0.2%top 91.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certificate verification by default because the bundled config sets ssl_verify_peer to FALSE, which is passed to CURLOPT_SSL_VERIFYPEER. On-path attackers can present any certificate to intercept Google Maps web-service requests, steal the API key from the query string, and tamper with responses.

Affected products (as reported)

Vendor	Product	Versions
alexpechkarev	google-maps	1.0.3 – through 12.16

Weakness: CWE-295 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References

GitHub Issue #123 issue-tracking
https://github.com/alexpechkarev/google-maps product
https://github.com/alexpechkarev/google-maps/blob/v12.16/src/config/googlemaps.php#L28 technical-description
https://github.com/alexpechkarev/google-maps/blob/v12.14/src/WebService.php#L267-L269 technical-description
VulnCheck Advisory: alexpechkarev/google-maps through 12.16 Disabled TLS Certificate Verification via ssl_verify_peer third-party-advisory