Thumbor has path traversal via post-validation URL decoding bypass in file_loader (CVE-2026-53502) | HOL Guard CVE