#1.6.3

#14/10/2026

1. [](#fix)

   - The file manager no longer opens as a blank window on sites with a Content Security Policy that forbids `unsafe-eval`. JMedia now ships a production build of its script, which is also 10 times smaller.

   - Corrupt or unreadable images show the generic file icon instead of a broken thumbnail.

   - Fixed a script error when opening JMedia in the administrator; the file area now fits the window on first load.

 

#1.6.1

#15/07/2026

1. [](#security)

   - Sanitize uploaded SVG (strip script/event-handlers/js: URIs) and serve files with nosniff + a sandbox CSP on inline SVG, closing a stored/reflected XSS via the preview/thumb parameter.

 

#1.6.0

#14/07/2026

1. [](#security)

   - Block executable-file uploads/writes (RCE) including polyglot names, strip execute bits on chmod, and add an SSRF guard on remote download.