Note that the public CVSS score for this vulnerability is too low - it has been scored as if it was a local vulnerability, when it can be exploited remotely.
This vulnerability is essentially a remote code execution vulnerability, as an attacker can use the LFI to obtain the Machine Key for the installation and then leverage this in the same way as a previous vulnerability discovered earlier in the year.
Attackers have knowledge of how to exploit this and there is no patch currently available. If you have an exposed instance, you must apply the mitigation discussed by Huntress in their post and consider that the server may be compromised.