Admidio: Authorization bypass in file_delete enables cross-folder file removal by authenticated users without delete privileges (CVE-2026-47226) | HOL Guard CVE