Sftpgo
Full-featured and highly configurable SFTP, HTTP/S, FTP/S and WebDAV server – S3, Google Cloud Storage, Azure Blob
What’s new
Verified 1h ago### Bug fixes
- WebDAV: return the correct ETag after an upload, or no ETag when it is unavailable.
- An instance that starts with an empty admins table kept serving the setup page until restart; instances backed by a shared SQL provider now re-check the database.
- OIDC: bound the authorization request to the user agent.
### Security fixes
- Share links were not revoked when the owning account was disabled or expired. [GHSA-5jhj-cjcp-jr8r](https://github.com/drakkan/sftpgo/security/advisories/GHSA-5jhj-cjcp-jr8r).
- Unbounded memory allocation when parsing SCP protocol records. [GHSA-j4w8-6gjf-fqvg](https://github.com/drakkan/sftpgo/security/advisories/GHSA-j4w8-6gjf-fqvg).
- WebClient: Stored cross-site scripting through directory names. Reported by ERNW. [GHSA-f9qc-3v4f-32w3](https://github.com/drakkan/sftpgo/security/advisories/GHSA-f9qc-3v4f-32w3).
- File pattern filters were not evaluated on the source of a copy. [GHSA-wwv9-g5x4-966q](https://github.com/drakkan/sftpgo/security/advisories/GHSA-wwv9-g5x4-966q).
### Hardening
- Downloading a share restricted to a single directory as a ZIP archive could extend the share to the owner's entire file system; this
Full release notes →
- WebDAV: return the correct ETag after an upload, or no ETag when it is unavailable.
- An instance that starts with an empty admins table kept serving the setup page until restart; instances backed by a shared SQL provider now re-check the database.
- OIDC: bound the authorization request to the user agent.
### Security fixes
- Share links were not revoked when the owning account was disabled or expired. [GHSA-5jhj-cjcp-jr8r](https://github.com/drakkan/sftpgo/security/advisories/GHSA-5jhj-cjcp-jr8r).
- Unbounded memory allocation when parsing SCP protocol records. [GHSA-j4w8-6gjf-fqvg](https://github.com/drakkan/sftpgo/security/advisories/GHSA-j4w8-6gjf-fqvg).
- WebClient: Stored cross-site scripting through directory names. Reported by ERNW. [GHSA-f9qc-3v4f-32w3](https://github.com/drakkan/sftpgo/security/advisories/GHSA-f9qc-3v4f-32w3).
- File pattern filters were not evaluated on the source of a copy. [GHSA-wwv9-g5x4-966q](https://github.com/drakkan/sftpgo/security/advisories/GHSA-wwv9-g5x4-966q).
### Hardening
- Downloading a share restricted to a single directory as a ZIP archive could extend the share to the owner's entire file system; this
Official download sources
Each source below has been validated against an approved publisher domain and editorially approved. Links route through a safe internal redirect.
Verified checksum File integrity
No threats detected — 0/69 engines VirusTotal ↗Verify your downloaded file matches the publisher’s official hash before installing.
SHA-256
63d29355dbcb7690ba1a2f58a4f8e6db4320275c056e9d48141d258204bec31b
Install with one command
Prefer a package manager? Paste this into Windows Terminal:
winget
winget install --id drakkan.SFTPGo -e
scoop
scoop install sftpgo
choco
choco install sftpgo -y
Platforms: Windows
Sftpgo compared
A factual, side-by-side overview based only on verified data.
Alternatives to Sftpgo
Verified, official downloads in the same category.
Frequently asked questions
Where can I download Sftpgo safely?
Use the official sources listed on this page. Each link is validated against an approved publisher domain and routes through a safe internal redirect — no third-party or bundled installers.
Which platforms does Sftpgo support?
Sftpgo is available for Windows.
Is this the official Sftpgo download?
Yes. Every source shown here is validated against the publisher’s approved domain and editorially reviewed before being published.
Who develops Sftpgo?
Sftpgo is developed by drakkan.
What are the best alternatives to Sftpgo?
Popular alternatives include Dify, PSP-UFU and Kopia. See the comparison above for a side-by-side overview.
Reviews & ratings
No reviews yet — be the first to share your experience.
Write a review