CVE-2026-105222
CRITICAL
INFO
Priority: 0.02
BB Relevance:
68/100
Published: 2026-10-04
Modified: 2026-10-27
First seen: 2026-10-29
Status: active
Attack Surface
Network
No Auth
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
High
PR:
None
UI:
None
AT:
Present
VC:
High
VI:
High
VA:
None
Description
The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certificate verification by default because the bundled config sets ssl_verify_peer to FALSE, which is passed to CURLOPT_SSL_VERIFYPEER. On-path attackers can present any certificate to intercept Google Maps web-service requests, steal the API key from the query string, and tamper with responses.