Handcrafted repo metadata may cause arbitrary local files to be overwritten by libzypp (CVE-2026-25707) | HOL Guard CVE