md-fileserver: Stored/Reflected XSS when viewing Markdown (raw HTML allowed) (CVE-2026-46492) | HOL Guard CVE