Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation (CVE-2026-48013) | HOL Guard CVE