thumbnail CrushFTP Authentication Bypass - CVE-2025-2825