alexpechkarev/google-maps EUVD-2026-92135

No special application configuration is required - the package is insecure by default: the bundled googlemaps.php sets ssl_verify_peer to FALSE, so every deployment that does not manually override it disables CURLOPT_SSL_VERIFYPEER. The decisive limiting factor is positional: the attacker must achieve an on-path/man-in-the-middle vantage point on the network path between the Laravel app and Google's Maps web service (reflected by AC:H and AT:P). No authentication (PR:N) and no user interaction (UI:N) are needed once that position is held. Realistic exploitation is therefore confined to hostile or compromised networks (public Wi-Fi, rogue proxy, DNS/ARP spoofing, compromised upstream), not arbitrary remote attackers on the open internet.

The CVSS 4.0 base score of 9.1 is driven by high confidentiality and integrity impact (VC:H/VI:H) - a stolen Google Maps API key plus the ability to tamper with geocoding/map responses. However, the same vector tempers real-world likelihood significantly: AC:H and AT:P mean the attacker must already occupy an on-path/machine-in-the-middle position between the Laravel application and Google's web services, which is a meaningful prerequisite rather than trivial remote reach. No EPSS score was provided in the input, so exploitation probability cannot be quantified; there is no CISA KEV listing and no public exploit code identified, so this is a design/configuration weakness (CWE-295, insecure default) rather than a confirmed actively-exploited flaw. Net assessment: a genuinely serious defect because it ships insecure-by-default and affects every deployment that does not override the config, but the on-path requirement makes it a high-priority hardening item rather than an imminent mass-exploitation emergency. Note the conflicting-signal caveat: the raw 9.1 reads 'critical,' yet the AC:H/AT:P requirements place realistic exploitation in targeted/hostile-network scenarios (public Wi-Fi, compromised upstream, malicious proxy) - defenders should weight it accordingly.

A Laravel application using this package runs in an environment where an attacker can intercept outbound traffic (e.g., a compromised network segment, malicious proxy, or hostile Wi-Fi). Because ssl_verify_peer defaults to FALSE, the attacker presents any TLS certificate, decrypts the request to Google's Maps web service, and reads the API key embedded in the query string while silently altering the returned map/geocoding data. No public exploit code was identified, but the attack uses standard off-the-shelf MITM tooling.