diff --git a/www/pad/inner.js b/www/pad/inner.js
index 0ab12ddb3..73dc00e75 100644
--- a/www/pad/inner.js
+++ b/www/pad/inner.js
@@ -725,6 +725,7 @@ define([
 
             var fmConfig = {
                 ckeditor: editor,
+                dropArea: $inner,
                 body: $('body'),
                 onUploaded: function(ev, data) {
                     var parsed = Hash.parsePadUrl(data.url);
@@ -743,7 +744,24 @@ define([
                     editor.widgets.initOn(element, 'mediatag');
                 }
             };
-            window.APP.FM = framework._.sfCommon.createFileManager(fmConfig);
+            var FM = window.APP.FM = framework._.sfCommon.createFileManager(fmConfig);
+
+            editor.on('paste', function (ev) {
+                try {
+                    var files = ev.data.dataTransfer._.files;
+                    files.forEach(function (f) {
+                        FM.handleFile(f);
+                    });
+                    // If the paste data contains files, don't use the ckeditor default handlers
+                    // ==> they would try to include either a remote image URL or a base64 image
+                    if (files.length) {
+                        ev.cancel();
+                        ev.preventDefault();
+                    }
+                } catch (e) {
+                    console.error(e);
+                }
+            });
 
             framework._.sfCommon.getAttribute(['pad', 'spellcheck'], function(err, data) {
                 if (framework.isReadOnly()) { return; }
diff --git a/www/poll/inner.js b/www/poll/inner.js
index 0dd4409ce..ae99ac9cd 100644
--- a/www/poll/inner.js
+++ b/www/poll/inner.js
@@ -2,6 +2,7 @@ define([
     'jquery',
     '/common/toolbar.js',
     '/common/common-util.js',
+    '/common/common-hash.js',
     '/bower_components/nthen/index.js',
     '/common/sframe-common.js',
     '/common/common-realtime.js',
@@ -32,6 +33,7 @@ define([
     $,
     Toolbar,
     Util,
+    Hash,
     nThen,
     SFCommon,
     CommonRealtime,
@@ -940,6 +942,23 @@ define([
         $('.CodeMirror').parent().prepend(markdownTb.toolbar);
         APP.toolbar.$bottomL.append(markdownTb.button);
 
+        // Add drop and paste handlers
+        var privateData = metadataMgr.getPrivateData();
+        var fmConfig = {
+            dropArea: $('.CodeMirror'),
+            body: $('body'),
+            onUploaded: function (ev, data) {
+                var parsed = Hash.parsePadUrl(data.url);
+                var secret = Hash.getSecrets('file', parsed.hash, data.password);
+                var fileHost = privateData.fileHost || privateData.origin;
+                var src = fileHost + Hash.getBlobPathFromHex(secret.channel);
+                var key = Hash.encodeBase64(secret.keys.cryptKey);
+                var mt = '<media-tag src="' + src + '" data-crypto-key="cryptpad:' + key + '"></media-tag>';
+                APP.editor.replaceSelection(mt);
+            }
+        };
+        common.createFileManager(fmConfig);
+
         // Initialize author name for comments.
         // Disable name modification for logged in users
         var $cName = APP.$addComment.find('.cp-app-poll-comments-add-name')