Uploading an image shouldn't mean leaving the field you're editing. The markdown editor's toolbar has an "insert image" button that opens a small popup with two options: paste a URL, or upload a file from your computer. Uploads go through the same admin session as the rest of the panel. The file gets checked both by extension and by actually decoding it as an image before it's accepted, so a renamed .txt file doesn't get through just because someone called it photo.jpg.

That same popup also lets you browse images you've already uploaded, so a second article reusing a hero image doesn't need a second upload. That list comes from a dedicated media library page in the panel's sidebar, which shows every file in uploads/ as a thumbnail (or a generic icon for anything that isn't an image), next to its size and a delete button.

Uploading straight from the media library works the same way, and it supports drag-and-drop. Drop one file or several onto the page and they upload automatically, with the grid filling in as each one finishes. Which extensions count as an "image" is a single setting in core/config.php. Want to also accept .webp or .svg? Change that one line, not every place in the code that happens to check a file extension.

Deleting a file removes both the original and its thumbnail, if it has one. And the delete endpoint only ever touches files inside uploads/, so there's no way to craft a filename that reaches outside it.