Security Flaw in Google Maps Laravel Package by Alex Pechkarev

CVE-2026-105222

What is CVE-2026-105222?

The Google Maps Laravel package by Alex Pechkarev, up to version 12.16, has a significant vulnerability where it disables TLS certificate verification by default. This is due to the configuration setting of ssl_verify_peer being set to FALSE. This flaw permits on-path attackers to generate fraudulent certificates, enabling them to intercept web service requests to Google Maps. They can not only extract sensitive information like API keys from the query string but also manipulate the responses being transmitted. Proper security measures should be implemented to ensure the integrity and confidentiality of the API interactions.

References