v2.7.5

Bug fixes

• httpd: make sure to always close connection for shares.

Security fixes

• Improper handling of malformed SSH channel requests. GHSA-q7pc-356p-hggc.

v2.7.4

New features

• Symbolic links: the new symlink_mode setting selects, per backend, whether clients holding the create_symlinks permission may create symbolic links on the local filesystem, the SFTP backend, or both. It is disabled by default. Creating a link requires create_symlinks on both the link's directory and the directory it points into, so per-directory permissions are enforced consistently on the path the client requests.
• OIDC redirect: the WebClient OIDC login now preserves a next redirect target across the IdP round-trip.

Bug fixes

• httpd: return after a CSRF failure in the web client login. The login POST handler rendered the CSRF error page but did not return, so execution fell through into the post-connect hook and the credential verification pipeline. Added the missing return to match the admin login, password reset, and setup handlers.

Hardening

• Improve symbolic links handling and add more test cases.
• httpd: clean and unify the WebClient post-login redirect target validation.

v2.7.3

New features

• Added a configurable minimum-entropy check (common.secret_min_entropy, default 80) for data-at-rest encryption secrets (CryptFs passphrase, S3 SSE-C key), to reject trivially weak key material at submission time.
• Logs: added the virtual path to transfer/command logs and to event-log CSV exports.
• WebClient: replaced glightbox with a custom lightbox implementation for better CSP compatibility.

Bug fixes

• IP list: fixed matching when an IP is covered by multiple conflicting entries.
• Fixed comparison of unordered slices.
• Shares: enforce max_tokens atomically via a guarded conditional update, closing a check-then-write race that could let a usage-capped share be used more times than allowed under concurrent access.
• In-memory reset-code manager: check code expiry at retrieval time instead of relying only on the background cleanup.

Security fixes

• Fixed a path-confinement bypass in the public browsable-share partial ZIP download. CVE-2026-49244.
• Fixed a stored XSS where the inline parameter on browsable-share and authenticated user file downloads suppressed Content-Disposition: attachment, allowing an attacker-supplied HTML file to execute in SFTPGo's web origin. These endpoints now always respond with Content-Disposition: attachment and the inline parameter has been removed. CVE-2026-49245.

Hardening

• Neutralized CSV formula injection in the Event Manager and event-log CSV exports: cells starting with =, +, -, @, tab or CR are now prefixed with a single quote.
• Username, folder, group and other object names now reject invisible Unicode formatting characters (e.g. zero-width joiners, bidirectional overrides, BOM) and line/paragraph separators, preventing the creation of invisible or visually confusable names and newline-like codepoints that could appear in paths and logs.
• WebClient: trigger a defender event on share login failure.

Notes

• Version 2.7.2 has been skipped due to an issue in the CI pipeline. Immutable releases were enabled, but the CI workflow had not yet been updated to support this change, causing the release process to fail.
• Linux package repositories have been moved. Please refer to the documentation for the updated repository URLs. The repositories provide packages for both x86_64 and arm64 architectures.

v2.7.1

New features

• SFTPD: Added support for OpenPubkey SSH, enabling tighter integration between OpenID Connect and SFTP.

Bug fixes

• Enforced password validation rules also when applied through a group.
• Fixed an issue where JSON dumps containing command actions failed to load correctly at startup when loaded as initial data.
• Data Provider: Fixed lock handling issues during migrations that could affect MySQL when migrations are executed concurrently by multiple instances.

Security fixes

• Fixed a potential path traversal and permission bypass involving specially crafted paths. CVE-2026-30914.
• Fixed placeholder sanitization in group home directories and key prefixes. CVE-2026-30915.

Backward incompatible changes

• Unified path handling: Prior to this release, the backslash character (\) was treated differently depending on the host operating system: on Linux, it was considered a standard character within a file or directory name, while on Windows, it acted as a path separator. We have now unified path handling across all platforms. Moving forward, both forward slashes (/) and backslashes (\) are strictly evaluated as path separators, independently of the underlying OS.

v2.7.0

v2.7.0

New Features

• SFTPD: Added support for Post-Quantum Traditional Hybrid Key Exchange through the newly added algorithm mlkem768x25519-sha256.
• JWT: replaced lestrrat-go/jwx with lightweight wrapper around go-jose. Implementing our own wrapper simplifies the codebase and improves maintainability. Moreover, go-jose depends only on the standard library, resulting in a leaner dependency that still meets all our requirements.
• WebUI: add French and German translations.
• Public shares: show disclaimer on login page.
• Enable setting password change requirements in user templates.
• DataProvider: preserve the initial sort order for related resources (such as folders and groups), improving compatibility and predictability when managing them with Terraform.
• Various internal refactoring, bug fixes, and minor improvements.

Bug Fixes

• OIDC: allow login if the password method is disabled.
• OIDC: ensure token username adheres to configured naming conventions.

Backward incompatible changes

• Removed Git support. Hosting Git repositories over SSH falls outside the intended scope of a file transfer solution, and the use of external commands introduces unnecessary security risks by increasing the attack surface. For example, a user could upload a Git repository containing custom hooks to their SFTPGo folder; when they push to the repository, a Git pre-receive hook shell script would be executed with the privileges of the sftpgo user. Thanks to @hyperreality for the detailed report.
• Removed rsync support. In the previous versions, rsync was executed as an external command, which means we have no insight into or control over what it actually does. From a security perspective, this is far from ideal. To be clear, there's nothing inherently wrong with rsync itself. However, if we were to support it properly within SFTPGo, we would need to implement the low-level protocol internally rather than relying on launching an external process. This would ensure it works seamlessly with any storage backend, just as SFTP does, for example. We recommend using one of the many alternatives that rely on the SFTP protocol, such as rclone.
• Remove startsubsys command: SFTPGo is not designed to be used as an OpenSSH subsystem: many features do not work correctly in subsystem mode. The functionality was added after a user request in the pkg/sftp repository to demonstrate that it was feasible using pkg/sftp, not for actual practical use.
• Removed legacy data retention REST API, use the EventManager instead.
• EventManager: Placeholder names must now use the format {{.VirtualPath}} (previously {{VirtualPath}}). Existing placeholders are automatically converted during update.

Windows binaries

Starting with this release, Windows binaries for SFTPGo will no longer be signed.
Over the past year, we’ve been using Azure Trusted Signing to obtain a personal code signing certificate. Unfortunately, due to changes in Azure’s policies, renewing that certificate is no longer possible.

For this release, I manually downloaded and signed the Windows installer generated via GitHub Actions using a new company certificate, which required offline signing. However, the binaries included in the installer are not individually signed.

Since manually downloading and signing each new installer is not a sustainable process, future Windows releases may be distributed without code signing.

We understand that signed binaries can make installation easier and build trust, and we’ll keep evaluating possible solutions for automated and transparent signing in the future.

v2.6.6

• Update golang.org/x/crypto/ssh to v0.35.0 to fix CVE-2025-22869
• CI: switch to Go 1.23

v2.6.5

New Features

• EventManager: added placeholders for year, month, day, hour, minute.
• Data provider: added link to upgrade documentation if upgrade fails because version is too old.

Bug Fixes

• rsync: enforce a supported format and limit the allowed options. CVE-2025-24366. Thanks to @ateamjkr for reporting.
• WebUIs: fix for scrollbar not displaying in navigation sidebar.

v2.6.4

Bug Fixes

• OIDC session cookie: use a cryptographically secure opaque random string, as we already do in all other security-sensitive code in SFTPGo. CVE-2024-52801. Thanks to @denisvr72 for reporting.
• EventManager: fix connection leak when performing file operations on a third-party SFTP server, for example, to copy a file to another SFTP server after an upload.

CI

• Switch to Azure Trusted Signing to sign Windows binaries.

v2.6.3

New features

• EventManager: system commands are disabled by default and an allow list has been added to explicitly define which ones are allowed. CVE-2024-52309. Thanks to @hyperreality for reporting.
• EventManager: add {{EscapedVirtualPath}} placeholder.
• EventManager: add {{DateTime}} placeholder.

Bug Fixes

• WebAdmin: check CSRF header when deleting blocked hosts in the same way we already do for all other state-changing endpoints.
• WebAdmin: correctly display multiple active connections for the same session.
• WebClient: improve readability of upload progress.
• Plugins: fix passing additional environment variables.

Backward incompatible changes

If you rely on EventManager to execute system commands, you should add the commands to the allowed list like this:

SFTPGO_COMMON__EVENT_MANAGER__ENABLED_COMMANDS="/bin/command1,/usr/bin/command2"

The following admin permissions have been removed:

• manage_admins
• manage_apikeys
• manage_system
• retention_checks
• manage_event_rules
• manage_roles
• manage_ip_lists

Now you need to add the * permission to replace the removed granular permissions because the removed permissions allow actions that should only be allowed to super administrators.
For example, you can define an administrator with the manage_system permission and not with the manage_admins or manage_user permission, but the manage_system permission allows you to restore a backup and then create users and administrators.
There is no point in having separate, overlapping permissions.

v2.6.2

Bug Fixes

• Update chi router to v5.0.14 to fix a bug with the compressor handler. It may affect our WebDAV implementation. More details.