The webp_transform plugin processes WebP images without adequate validation, which leads to unsafe decoding and the ability to serve cacheable responses with incorrectly labeled MIME types. This flaw, classified as CWE‑20, can cause clients to receive cached content that does not match the declared content type, potentially resulting in content spoofing or downstream confusion.

Apache Traffic Server versions 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3 are affected. All builds in these series contain the vulnerable webp_transform plugin.

The CVSS score of 8.2 signals a high severity vulnerability. The EPSS score of less than 1% indicates that automated exploitation attempts are currently rare, and the issue is not listed in the CISA KEV catalog. An attacker with network access to a publicly exposed Traffic Server instance could upload a malicious WebP file, causing the plugin to decode it unsafely and produce improperly labeled, cacheable responses. While the specific impact is mislabeling and potential cache poisoning, the possibility of further adverse effects would depend on additional contextual factors.