SFTPGo has path confinement bypass in public browsable share partial ZIP download (CVE-2026-49244) | HOL Guard CVE