SSRF via image import from URL allows internal network probing by authenticated users (CVE-2026-28385) | HOL Guard CVE