diff --git a/requirements/base.txt b/requirements/base.txt
index 382a7e1749..639b35f637 100644
--- a/requirements/base.txt
+++ b/requirements/base.txt
@@ -4,7 +4,7 @@ allpairspy==2.5.1
 bleach==6.1.0
 bleach-allowlist==1.0.3
 defusedxml==0.7.1
-Django==4.2.13
+Django==5.0.6
 django-attachments==1.11
 django-colorfield==0.11.0
 django-contrib-comments==2.2.0
diff --git a/tcms/core/widgets.py b/tcms/core/widgets.py
index aad24c7629..4852476a67 100644
--- a/tcms/core/widgets.py
+++ b/tcms/core/widgets.py
@@ -1,4 +1,4 @@
-#   Copyright (c) 2018,2021 Kiwi TCMS project. All rights reserved.
+#   Copyright (c) 2018-2024 Kiwi TCMS project. All rights reserved.
 #   Author: Alexander Todorov <info@kiwitcms.org>
 
 """
@@ -6,6 +6,7 @@
 """
 from django import forms
 from django.utils.dateparse import parse_duration
+from django.utils.safestring import SafeString
 
 
 class SimpleMDE(forms.Textarea):
@@ -24,9 +25,11 @@ def render(self, name, value, attrs=None, renderer=None):
             }
         )
         rendered_string = super().render(name, value, attrs, renderer)
-        rendered_string += f"""
+        rendered_string += SafeString(
+            f"""
 <input id="{self.file_upload_id}" type="file" style="display: none">
 """
+        )
         return rendered_string
 
     class Media: