Release Notes#
This page lists the changes for SFTPPlus version 6.
For compatibility changes and upgrade instructions, see Upgrading to SFTPPlus 6.
Release notes for earlier major versions are available below.
Version 6.3.0.pr7792, 2026-11-09#
Security Fixes#
Entra ID now supports mapping file transfer groups and administrator roles using only cloud group object IDs, avoiding unintended access through matching group names. Existing users are encouraged to migrate their group and role configurations to ID-only mapping. [server-side][entra-id] [#7525]
Incoming AS2 requests using HTTP Basic authentication now require AS2-From to match the authenticated account username. Previously, a valid login could send a different AS2-From value. Reused sessions enforce the same check. [#7705]
The mlkem768x25519-sha256 SSH key exchange is now supported and included in the secure cipher list for SFTP and SCP services. [#7762]
Role permissions now enforce stricter target and wildcard rules. Unsupported patterns are rejected to prevent deny rules from being bypassed. [#7768]
The bundled Python runtime is updated to version 3.14.10 and Twisted to version 26.10.0. [#7781]
New Features#
The Web Manager activity log can now filter events by cluster pool and instance name. Cluster pools, event groups, and components can be selected from predefined lists. [#3209]
You can now activate or suspend all transfers from Web Manager and choose whether enabled transfers start automatically with the server. This makes it easier to pause transfers for upgrades and migrations. [client-side] [#3248]
The Gen 3 Web Client now includes a Security page for changing passwords without logging out, with password visibility controls and a strength meter. Users receive warnings before their password or account expires, with an optional support contact configured by the administrator. Password recovery now displays password requirements after validating the recovery link, helping users choose a password that meets the policy. [#5557]
The Web Manager can now display and copy a component's INI configuration, and export the server configuration as an INI file for reference. [#5972]
Web Client gen3 can now upload files immediately from the Add menu and track their progress in a collapsible upload monitor. [#6924]
You can now define delegated accounts and administrators with access permissions managed in SFTPPlus and authentication provided by Google Identity. [server-side][google-identity] [#7525]
The Web Manager dashboard now shows recorded file transfer totals and seven-day activity charts in the server's local time, with tooltips showing daily values. Service and location pages also show transfer bytes by direction and outcome. The analytics resource stores activity history in a configurable local SQLite database. Local history can be disabled when using external monitoring instead. [#7642]
Prometheus metrics now report identity and status for configured services, locations, transfers, resources, authentications, and event handlers. Connection and authentication activity covers services and locations. File and byte activity covers services and locations. Byte counters separate successful and failed file operations. Separate transfer file and byte counters report completed transfer jobs. [#7646]
AS2 partner profiles now manage receive certificates, HTTP authentication requirements, and asynchronous MDN HTTPS trust. Accounts with AS2 certificates are linked to migrated partner profiles. Account credentials and file storage remain unchanged. [#7705]
AS2 locations now use dedicated local and partner profiles, allowing multiple locations to share identities, certificates, and connection settings. Existing AS2 locations are migrated automatically. [client-side][as2] [#7706]
HTTP and HTTPS services now select a local AS2 profile for receiving files. Existing services are updated automatically while their receiving settings remain in place. [server-side][as2] [#7740]
HTTP and HTTPS services can receive files in an account's home folder through raw POST requests at a dedicated URL, alongside existing AS2 and multipart uploads. [server-side][http] [#7749]
Administrators can choose from multiple OpenID Connect authentication methods on the Web Manager login page, including multiple methods from the same provider. [manager] [#7758]
The Web Manager identifies SSH algorithm families when configuring allowed algorithms, making it easier to select the intended entries. Selecting an SSH or SSL/TLS preset now replaces other choices in its list. [#7773]
Transfer schedule actions can now be edited in the Web Manager without first removing and recreating them. [#7788]
Defect Fixes#
Email delivery failures now report when the email resource cannot start, including failures during password recovery and test email delivery. [#5557]
OpenID Connect limits pending sign-ins per source IP address to prevent one client from exhausting the shared login capacity. [server-side] [#7525]
Changing the server's default private certificate now marks components that inherit it as requiring a restart. Previously, switching to a different certificate could leave those components using the old certificate without indicating that a restart was required. This bug was introduced in version 6.0.0. [server-side][client-side][https][ftps] [#7706]
SCP downloads no longer close prematurely, preventing intermittent failures and incomplete downloaded files. [#7709]
Role permissions for event handlers and vault items now use documented hyphenated family names. Existing event_handlers rules are converted when the configuration is loaded. [#7768]
Custom UUIDs are now validated when creating configuration components. Invalid IDs could disrupt administration of the affected component without crashing the application. Creating such an ID requires administrator access. This issue was introduced in version 4.14.0, when the manager API began accepting custom UUIDs. [server-side][manager] [#7773]
Password-protected PEM private keys can now be imported from files into private certificate vault items. [#7792]
Deprecations and Removals#
Cluster nodes must provide an instance name when logging in to the cluster controller. Upgrade the controller and all cluster nodes together; older nodes cannot authenticate to an upgraded controller. [#7646]
Analytics now always starts with SFTPPlus and manages the activity database. The separate SQLite resource has been removed, and its path setting is migrated to activity_database_path in the analytics resource. The default database is renamed from configuration/cache.db3 to configuration/activity-records.db3, preserving existing activity records. [#7697]
AS2 receiving is no longer available for accounts returned by external authentication methods. Configure a local account and associate it with an AS2 partner profile to receive AS2 messages. The account as2_trusted_certificates option is removed. Existing values are migrated to AS2 partner profiles; accounts without a partner profile cannot receive AS2 files. The group as2_require_http_authentication option is removed. Existing values are applied to inherited account settings during migration to AS2 partner profiles. [#7705]
AS2 locations no longer provide the configuration Test action. Use a transfer to send a file and verify AS2 delivery and receipt handling. [client-side][as2] [#7706]
The first-generation Web Client is no longer available. HTTP and HTTPS services configured for ui-gen-1 automatically use ui-gen-2 instead. [#7762]
Version 6.2.1, 2026-10-23#
Security Fixes#
SFTPPlus's bundled Mozilla Root CAs no longer include emSign ECC Root CA - G3, following the compromise of intermediate certificate authority keys. [client-side][https] [#7731]
New Features#
AS2 receive audit logs now identify the trusted certificate used to verify a file signature and the private certificate used to decrypt a file by their vault identifiers. [server-side][as2] [#5384]
AS2 MDN validation now accepts double quotes around MIC algorithm names, improving compatibility with AS2 partners that return this format. [client-side][as2] [#5591]
The Web Manager now provides a guided table for source IP filtering in accounts, groups, administrators, roles, security policies, and cluster pools. Rules are validated before they are added, and CIDR values are automatically converted to network addresses. Source IP rules in account, group, administrator, and role summaries are now displayed on separate lines. [manager] [#5729]
Successful AS2 responses now consistently return HTTP 200 to improve compatibility with other AS2 implementations. The previous HTTP 201 response was also correct, but some implementations did not accept it. [server-side][as2] [#6482-1]
AS2 transfers now archive received MDN receipts alongside files in the success or failure archive. [client-side][server-side][as2] [#6482]
The Web Manager now provides separate fields for the login information link, title, and message. [manager] [#6853]
The third-generation Web Client now displays files and folders in a table, with folder navigation, breadcrumbs, and light and dark themes.
Expired sessions return to login without a browser authentication prompt. Missing paths display an error in the third-generation interface. Signing in after opening a direct link returns to the requested path. Browser links use paths from the site root; older /home/ links redirect to the new addresses. [server-side][https] [#7043]
Source IP filters now accept country codes and autonomous system numbers. Administrators can update the GeoIP database and inspect its entries using new administrative commands. [server-side][client-side] [#7582]
Transfers can now convert UTF-16 and ISO-8859-15 text files to UTF-8 with a byte order mark (BOM). [client-side] [#7720]
HTTP-pull locations now include configured headers in authentication requests. You can set a separate authentication path on the same server and choose the HTTP method when needed. [client-side][http] [#7754]
Defect Fixes#
Web Client and Web Manager services on different ports of the same hostname can now be used at the same time without disrupting each other's sessions. [server-side][https][manager] [#5299]
AS2 transfers now accept signed files when the requested receipt signature uses a different digest algorithm from the file signature. [server-side][as2] [#5364]
Certificate vault identifiers now change when a certificate is renewed with the same public key, making audit records distinguish each certificate. [server-side][vault] [#5384]
The Web Manager clears the restart warning when a component fails to restart. [manager] [#5505]
AS2 transfers requiring a private certificate are now rejected with a clear server log message when no certificate is configured, instead of failing with an internal server error. [server-side][as2] [#5583]
Concurrent AS2 uploads with the same filename no longer interfere with each other. The last upload to finish replaces the destination file. [server-side][as2] [#6082]
AS2 transfers now support sending empty files. [client-side][server-side][as2] [#6482]
Transfers converting text to UTF-16 now write the byte order mark only once at the start of the destination file. [client-side] [#7720]
Version 6.1.2, 2026-10-13#
Version 6.1.0 released on 2026-10-09, and 6.1.1 were released on 2026-10-12, as a release candidate.
Security Fixes#
HTTP/HTTPS services configured to receive forwarded requests via a reverse proxy now reject direct OpenID Connect login requests that lack the required proxy origin headers, even when a Referer header is present. To support both direct and proxied access, configure two separate services: one with client_forwarded_header empty for direct access, and another with forwarded headers configured for access through the reverse proxy. [server-side][entra-id][okta][https] [#5782]
Tracebacks are now excluded from event data and default email, log, and webhook output to prevent disclosure of sensitive information. All event handler templates can explicitly include tracebacks using {tb}. Event handling also uses less memory by generating JSON data only on demand. [server-side][client-side] [#7684]
Vault items now report an error whenever parsing produces no usable content. Previously, trusted certificate and pinned key items created from nonempty input without usable PEM content could silently disable TLS server identity verification, allowing an untrusted server to be accepted. [client-side][ftps][https] [#7698]
New Features#
The Web Manager now stores a preferred color theme for each administrator and applies it automatically after login. The preference is available on the administrator's settings page. Theme changes are saved automatically after 15 seconds without further changes, while preserving other pending configuration edits. [manager] [#2174]
A Helm chart is available as an option for installing SFTPPlus on Kubernetes. [server-side][kubernetes] [#3036]
Administrators can configure the SSH receive window and maximum packet size for each SFTP and SCP service to improve uploads over high-latency connections. The receive window now defaults to 2 MiB instead of 128 KiB. [server-side][sftp][scp] [#4654]
Cluster nodes now advertise their configured node name, or the local hostname when no name is configured, during synchronization with the controller. [server-side][cluster] [#5461]
Standard output and local file event handlers now support Logfmt output. [server-side][client-side][logs] [#5786]
Missing event data fields no longer interrupt text or CSV logging. [logs] [#5786]
The Web Manager now provides permission selectors and an ordered path rule table for configuring account and group file access. [manager] [#5790]
The Web Manager now exports Prometheus metrics for process start time, application metadata, resource usage, and reactor delay at /metrics. [manager][kubernetes] [#6292]
The Web Manager activity log now shows the estimated country and network organization for public IP addresses in newly recorded events. [manager] [#6423]
Application authentication can now continue to another authentication method when an account belongs to none of its allowed groups. [server-side] [#6487]
Transfers can be scheduled on the 28th through 31st or on the last or second-last day of each month. Days absent from a month are skipped. [client-side] [#7019]
Certificate expiration warnings now cover AS2 private and partner certificates configured for accounts, services, and locations, as well as TLS certificates used by locations, resources, authentications, and event handlers. [manager] [#7585]
The Web Manager group configuration now provides a list for adding and removing home folder structure directories. [manager] [#7615]
The Web Manager provides a virtual folder editor for accounts and groups, with separate virtual and local paths and a local filesystem browser. [manager] [#7617]
Account and group permissions are now configured separately using default_permissions and path_permissions. [server-side] [#7618]
Azure BLOB and Azure Files locations, and Exchange Online locations, can now authenticate using Azure Workload Identity. Kubernetes deployments can access these services without storing a client secret or storage access key. [client-side][kubernetes] [#7629]
Transfer schedules can now be configured in the Web Manager using start and stop actions, day selections, and a time picker. [manager] [#7679]
Events now include a severity level and a peer address shortcut. New standard output loggers use these fields in their default Logfmt output for easier integration with Grafana and Loki. [logs][kubernetes] [#7686]
Cluster nodes can now test their controller connection and configure trusted certificates directly during initial setup or from the synchronization resource in Web Manager. [cluster][server-side] [#7698]
The Web Manager can export the full public certificate chain without the private key, and export or copy all trusted certificates. Pasted PEM content with whitespace around each line is accepted. [manager] [#7700]
Defect Fixes#
AS2 uploads no longer fail with Context was already finalized when a transfer pauses and resumes. [client-side][as2] [#5591]
Web Client browser requests that fail during processing now return to the login page instead of displaying a plain error page. JSON requests receive an internal server error response in JSON format. [server-side][https] [#5782]
Reduced CPU usage when viewing component status and configuration. [manager] [#7547]
Monitoring large folders is faster when the location does not provide file identifiers. [client-side] [#7681-1]
Event handlers use less CPU when formatting timestamps and CSV log entries. [logs][event-handlers] [#7681]
Services now release their listening ports when startup fails, allowing them to restart after the configuration is corrected. [server-side][ftp][sftp][https] [#7702]
Deprecations and Removals#
The event handler servers filter is replaced by pool_uuids. Existing configuration values are migrated automatically. [event-handlers] [#5461]
Log messages no longer contain newline characters. Carriage returns and line feeds are replaced with spaces, with each CRLF pair replaced by a single space. [logs][event-handlers] [#5786]
The implicit No default for account create_home_folder has been removed. Accounts without this setting now inherit their primary group's value. [server-side] [#6487]
Python API extensions now receive read-only event data in getConfiguration(). Extensions that change data there must create a copy. The worker's handle() method still receives a mutable event copy. [api][event-handlers] [#7681]
Account information is no longer included in data.avatar or {data_json}. The {data.avatar} and {data.avatar.ATTRIBUTE} placeholders are no longer available. Use {account} and {account.ATTRIBUTE} instead, for example {account.name}. Existing handler INI templates are automatically migrated. [event-handlers] [#7684-1]
Tracebacks are no longer included in event data or {data_json}, including email templates. Use {tb} to explicitly include a traceback. Serialized events no longer include the legacy empty data_json field. The {data_json} placeholder remains available in event handler templates. [event-handlers] [#7684]
Version 6.0.0, 2026-09-18#
Security Fixes#
The embedded Python version used by SFTPPlus was updated to version 3.14.7. [#7471]
The OpenSSL library was updated to version 4.0.1. [#7504]
New Features#
The Web Manager now provides light and dark theme controls. The browser remembers the selected theme across sessions. [manager] [#5602]
The Web Manager and management API now show the signature algorithm, certificate SHA-256 fingerprint, and public-key SHA-256 fingerprint for certificates. [manager] [#7526]
The Web Manager now warns Internet Explorer 11 users that their browser is no longer supported and directs them to SFTPPlus version 5 when IE11 is required. [#7565]
Cluster nodes are now configured in pools that share a name, password, and configuration. Web Manager uses pool names when configuring cluster access. Existing cluster-nodes sections are automatically migrated to cluster-pools, and the node synchronization username option is migrated to pool_name. An optional node_name setting is available and defaults to empty. [#7577]
Defect Fixes#
The Web Manager API now checks vault-item read permissions when including an existing vault item's content in a pinned-key import. [#7597]
Deprecations and Removals#
Service configuration returned by the Web Manager JSON-RPC API is now flat. Integrations must read and update protocol options directly on the service, without the nested configuration object or configuration/ path segment. Existing INI configuration files are unchanged. [#2599]
The event handler groups configuration option was renamed to event_groups to distinguish it from account groups. Existing configurations are automatically migrated without changing event filtering behavior. If both options are configured, event_groups is used. [#6521]
On Linux, the IBM MQ C client and Microsoft Purview SDK libraries are now available in a separate extra-connectors archive. IBM MQ locations and Microsoft Purview event handlers report a clear installation error when their extra-connectors files are missing. Windows packages continue to include both connectors. See the version 6 upgrade guide for connector installation and startup configuration instructions. [#7165]
SSL v3 is no longer supported. [#7471-1]
You can no longer generate Certificate Signing Requests or self-signed certificates using the SHA-1 algorithm. [#7471]
The Web Manager service no longer supports Internet Explorer 11. Use Firefox, Chrome, Edge or other modern web browsers. Microsoft ended support for Internet Explorer 11 in 2022. [manager] [#7565]
The Python API for extending LDAP authentication has been removed, including the extension_entry_point and extension_configuration options. Custom LDAP extensions and the bundled extension for validating TOTP codes using secrets stored in LDAP are no longer supported. Before upgrading, replace any authentication checks provided by these extensions and remove the obsolete configuration options. LDAP servers that validate TOTP codes themselves remain supported. [#7575]
The obsolete legacy-webadmin HTTP event format has been removed. Event handlers configured with this format fail to start with an unknown format error. [#7590-1]
HTTP authentication methods and HTTP event handlers now accept a single URL. Support for fallback URLs has been removed. Existing comma-separated URL lists are automatically migrated to their first value; all remaining values are discarded. HTTP event handlers continue to support retrying that endpoint using retry_count and retry_increase. [#7590]
The deny-username and ip-time-ban authentication methods are no longer supported. Their settings are migrated to the default security policy, preserving values already configured in that policy. The default legacy sections and their authentication references are removed. Other legacy sections remain as disabled placeholders. Services using a custom security policy must have the corresponding restrictions configured in that policy. [#7591]
The anonymous authentication method is no longer supported. Existing anonymous authentication configurations remain as disabled placeholders. Use an application account with a password for file transfer access. [#7596]