Jetpack CRM < 5.4.0 - PHAR Deserialisation via CSRF

Description

The plugin does not have CSRF proper check in step 2 and 3 of the zeroBSCRM_CSVImporterLitehtml_app function, which then call file_exists() on user input, which could allow unauthenticated users to perform PHAR Deserialisation attacks if they can upload a malicious file using a gadget chain, and then make a logged in admin open a page or link.