If you have multiple PHP installations / docker containers running PHP to fix the security vulnerability now and don't want all the manual labor:
I am running multiple companies with many Linux servers. Of those, many run docker images of Wordpress, Nextcloud, Matomo, etc with Traefik. To patch this PHP hole, I added a security audit tool into our software "Infinity Tools" - from the TUI main menu under "Security & Access > Security Audit". It screens all Docker containers for that vulnerability as well as the host system and offers support in e. g. pulling the latest Wordpress container. Then you can re-run the checker to see, if the issue is patched. Worked for me on Wordpress, Nextcloud and Matomo. Bookstack is not patched yet (on Infinity Tools >> Docker Manager you can also stop containers).
Then, under Security & Access >> Traefik, you can also enable a PHP RCE shield, if you are using Traefik until everything is patched. It blocks uploads (and the hole) for PHP, too.
Infinity Tools are free for personal use under https://speedbits.io/products/infinity-tools