CodeIgniter: Uploaded file extension validation bypass in `ext_in` rule (CVE-2026-48062) | HOL Guard CVE