XSS problem

[zmj888]

If upload a pdf file which contains xss js content. Will show alert like this

[kartik-v]

Set content preview to off and use icon previews if you really want to be safe and protect from XSS and bad content. Note that if you enable thumbnail previews for PDF - then PDF rendering is done not by the plugin but by browser (plugin) or via the library PDFJS (so it needs to be checked with those). For HTML content previews however, the plugin uses its capability to render safe HTML.