The webp_transform plugin processes WebP images without adequate validation, which allows it to decode unsafe data and return cacheable responses that are incorrectly labeled. As a result, clients may receive content with a MIME type that does not reflect the actual payload, leading to content spoofing or confusion. This vulnerability is classified as CWE‑20.

Apache Traffic Server versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3 are affected. All builds in these series contain the vulnerable webp_transform plugin.

The CVSS score of 8.2 signals a high severity vulnerability. The EPSS score of less than 1% indicates that automated exploitation attempts are currently rare, and the issue is not listed in the CISA KEV catalog. The likely attack vector is that an attacker with network access to a publicly exposed Traffic Server instance could upload a malicious WebP file, causing the plugin to decode it unsafely and produce improperly labeled, cacheable responses; this scenario is inferred from the description rather than stated explicitly. While the specific impact is mislabeling and potential cache poisoning, the possibility of further adverse effects would depend on additional contextual factors.