sftpgo

v2.7.4 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 29d File Storage & Sync

✓ No known CVEs patched

This release patches 2 known CVEs

Topics

azure-blob cloud-storage data-at-rest-encryption docker ftp ftp-server

+12 more

go google-cloud-storage multi-factor-authentication portable prometheus proxy-protocol s3 scp sftp sftp-server webdav webdav-server

Affected surfaces

auth rbac

Summary

AI summary

Updates New features, Hardening, and Bug fixes across a mixed release.

Full changelog

Symbolic links: the new symlink_mode setting selects, per backend, whether clients holding the create_symlinks permission may create symbolic links on the local filesystem, the SFTP backend, or both. It is disabled by default. Creating a link requires create_symlinks on both the link's directory and the directory it points into, so per-directory permissions are enforced consistently on the path the client requests.
OIDC redirect: the WebClient OIDC login now preserves a next redirect target across the IdP round-trip.

httpd: return after a CSRF failure in the web client login. The login POST handler rendered the CSRF error page but did not return, so execution fell through into the post-connect hook and the credential verification pipeline. Added the missing return to match the admin login, password reset, and setup handlers.

Unified and cleaned WebClient post‑login redirect validation, improving redirection handling security
Fixed CSRF failure path in web client login to return immediately after error rendering, preventing unintended execution

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track sftpgo

Get notified when new releases ship.

About sftpgo

Full-featured and highly configurable SFTP, HTTP/S, FTP/S and WebDAV server - S3, Google Cloud Storage, Azure Blob