tmp: Type-confusion bypass of _assertPath allows path traversal via non-string prefix/postfix/template (CVE-2026-49982) | HOL Guard CVE