YARD static cache reads raw traversal paths before router sanitization (CVE-2026-49342) | HOL Guard CVE