diff --git a/services/context/context_template.go b/services/context/context_template.go
index c458912e69..87877095ab 100644
--- a/services/context/context_template.go
+++ b/services/context/context_template.go
@@ -132,8 +132,9 @@ func (c TemplateContext) HeadMetaContentSecurityPolicy() template.HTML {
 	//    * Maybe this approach should be avoided, don't make the config system too complex, just let users use A
 	return template.HTML(`<meta http-equiv="Content-Security-Policy" content="` +
 		// allow all by default (the same as old releases with no CSP)
-		// maybe some images or markup (external) renders need "data:", need to investigate
-		`default-src * data:;` +
+		// * maybe some images or markup (external) renders need "data:", need to investigate
+		// * avatar upload editor needs "blob:", at least "img-src" and "content-src"
+		`default-src * data: blob:;` +
 
 		// enforce nonce for all scripts, disallow inline scripts
 		`script-src * 'nonce-` + c.CspScriptNonce() + `';` +