Laravel 5.4.32 is now released and it includes a security fix for apps that accept local image uploads and a revert on a recent change to the “BelongsToMany::create()” method.
If your app allows local image uploads you should upgrade to this version now. Below is a complete list of changes.
v5.4.32 Changelog: Added Added FilesystemAdapter::path() method ( #20395 ) Changed Allow Collection::random() to return 0 items ( #20396 , #20402 ) Accept options on FilesystemAdapter::temporaryUrl() ( #20394 ) Sync withoutOverlapping method on Event and CallbackEvent ( #20389 ) Prevent php file uploads by default unless explicitly allowed ( #20392 , #20400 ) Allow other filesystem adapter to implement temporaryUrl() ( #20398 ) Fixed Reverted breaking change on BelongsToMany::create() ( #20407 )