[6.x] Arbitrary Code Execution due to Improper Input Handling vulnerability in flag importer form

We don't need a copy of the issue for a different version; it can be backported once fixed on the current branch.