PhpWeasyPrint vulnerable to PHAR deserialization via output filename (CVE-2023-28115 case-insensitive bypass) (CVE-2026-49286) | HOL Guard CVE