How to Install / Upgrade: Django security releases issued: 6.0.8 and 5.2.17

Django security releases 6.0.8 and 5.2.17 are out from the Django Weblog. The Django team issued them under its security release policy to address security issues, including CVE-2026-15307 related to server-side fil. All Django users are encouraged to upgrade as soon as possible.

If you are on the 6.0 line, install Django 6.0.8. If you are on the 5.2 line, install Django 5.2.17. With pip, pin the matching release for your series, for example pip install "Django==6.0.8" or pip install "Django==5.2.17", then reinstall from your requirements or lockfile so the new version is what your environments actually run. Redeploy or restart the app processes that import Django after the package update lands.

Do not mix series: 6.0 users should take 6.0.8, and 5.2 users should take 5.2.17. Confirm the installed version reports 6.0.8 or 5.2.17 in the environment you deploy from, and treat this as a security upgrade rather than an optional patch.