diff --git a/qt/aqt/mediasrv.py b/qt/aqt/mediasrv.py
index 330c4c586..92cfb7432 100644
--- a/qt/aqt/mediasrv.py
+++ b/qt/aqt/mediasrv.py
@@ -62,6 +62,7 @@ flask_cors.CORS(
         r"/_anki/js/vendor/mathjax/output/chtml/fonts/woff-v2/.*.woff": {
             "origins": "*"
         },
+        r"/media/.*": {"origins": "*"},
         r"/*": {"origins": "127.0.0.1"},
     },
 )
@@ -481,6 +482,7 @@ def _extract_request(
     if not aqt.mw.col:
         return NotFound(message=f"collection not open, ignore request for {path}")
 
+    path = path.removeprefix("media/")
     path = hooks.media_file_filter(path)
     return LocalFileRequest(root=aqt.mw.col.media.dir(), path=path)
 
diff --git a/ts/routes/reviewer-inner/index.ts b/ts/routes/reviewer-inner/index.ts
index dd8d71d89..fa877d571 100644
--- a/ts/routes/reviewer-inner/index.ts
+++ b/ts/routes/reviewer-inner/index.ts
@@ -101,7 +101,7 @@ addEventListener("keydown", (e) => {
 });
 
 const base = document.createElement("base");
-base.href = "/";
+base.href = "/media/";
 document.head.appendChild(base);
 
 function pycmd(cmd: string) {