thumbnail SessionReaper, unauthenticated RCE in Magento & Adobe Commerce (CVE-2025-54236)