diff --git a/src/main/controllers/web.zig b/src/main/controllers/web.zig
index 5ec6d55..993b773 100644
--- a/src/main/controllers/web.zig
+++ b/src/main/controllers/web.zig
@@ -281,6 +281,7 @@ const drive = struct {
         const Action = enum {
             mkdir,
             delete,
+            upload,
         };
 
         pub const body_tag_from_query_param = "action";
@@ -289,9 +290,15 @@ const drive = struct {
                 name: []const u8,
             },
             delete: struct {},
+            upload: struct {
+                file: http.FormFile,
+                sensitive: bool = false,
+                description: []const u8 = "",
+            },
         };
 
         pub fn handler(req: anytype, res: anytype, srv: anytype) !void {
+            const trimmed_path = std.mem.trim(u8, req.args.path, "/");
             switch (req.body) {
                 .mkdir => |body| {
                     _ = try srv.driveMkdir(req.args.path, body.name);
@@ -300,7 +307,6 @@ const drive = struct {
                     try servePage(req, res, srv);
                 },
                 .delete => {
-                    const trimmed_path = std.mem.trim(u8, req.args.path, "/");
                     _ = try srv.driveDelete(trimmed_path);
 
                     const dir = trimmed_path[0 .. std.mem.lastIndexOfScalar(u8, trimmed_path, '/') orelse trimmed_path.len];
@@ -312,6 +318,27 @@ const drive = struct {
                     try res.headers.put("Location", url);
                     return res.status(.see_other);
                 },
+                .upload => |body| {
+                    const entry = try srv.driveUpload(
+                        .{
+                            .filename = body.file.filename,
+                            .dir = trimmed_path,
+                            .description = body.description,
+                            .content_type = body.file.content_type,
+                            .sensitive = body.sensitive,
+                        },
+                        body.file.data,
+                    );
+                    defer util.deepFree(srv.allocator, entry);
+
+                    const url = try std.fmt.allocPrint(srv.allocator, "{s}/drive/{s}", .{
+                        req.mount_path,
+                        std.mem.trim(u8, entry.file.path, "/"),
+                    });
+                    defer srv.allocator.free(url);
+                    try res.headers.put("Location", url);
+                    return res.status(.see_other);
+                },
             }
         }
     };
diff --git a/src/main/controllers/web/drive/directory.tmpl.html b/src/main/controllers/web/drive/directory.tmpl.html
index 39f4b2d..99ae73c 100644
--- a/src/main/controllers/web/drive/directory.tmpl.html
+++ b/src/main/controllers/web/drive/directory.tmpl.html
@@ -37,6 +37,30 @@
         <button type="submit">Create</button>
       </form>
     </div>
+    <div class="popup" id="upload">
+      <a class="button popup-open" href="#mkdir">
+        <i class="fa-solid fa-cloud-arrow-up"></i>
+      </a>
+      <a class="button popup-close" href="#">
+        <i class="fa-solid fa-xmark"></i>
+      </a>
+      <form class="popup-dialog" action="?action=upload" method="post" enctype="multipart/form-data">
+        <div>Upload</div>
+        <label>
+          <div>Select file</div>
+          <input type="file" name="file" />
+        </label>
+        <label>
+          <div>Description</div>
+          <input type="text" name="description" />
+        </label>
+        <label>
+          <div>Sensitive?</div>
+          <input type="checkbox" name="sensitive" />
+        </label>
+        <button type="submit">Upload</button>
+      </form>
+    </div>
   </div>
   <table class="directory-listing">
     {#for .dir.children.? |$child| =}