Magic Wormhole: receive, with --output pointing at an existing directory can be path-traversed (CVE-2026-42448) | HOL Guard CVE