Fixed vulnerabilities:

• TVFS: Fixed directory deletion and renaming potentially bypassing restrictions configured in mount points
• TVFS: Fixed simultaneous file requests potentially exceeding the limit on open files per session
• Web Client: Fixed shared-link tokens potentially being used to renew login sessions
• Web Client: All REST API requests and shared links now require HTTPS
• Web Client: Updated Quasar to fix a security vulnerability
• Web Client: Fixed filenames containing special characters being interpreted as HTML in delete confirmation dialogs
• Web Client: Limited request sizes, excluding file uploads, to prevent excessive memory use and server termination

New features:

• System users can now sign in without a password while accessing files with their system account's permissions
• Directories configured in mount points are now created when first accessed, rather than in advance
• UI: Expand a session to see its active transfers, their source addresses and start times, and the session's overall progress
• UI: Enable or disable individual listeners without removing their settings; protocol now appears before address and port
• New installations include disabled Web Client HTTPS listeners on port 443 for IPv4 and IPv6
• Added browser-based file access and sharing through the Web Client
• Web Client: Choose a light, dark or system theme and adjust text size and color intensity; preferences are remembered and shared across browser tabs
• Web Client: Administrators can choose sign-in as the default page when no public site is enabled, and All files as the destination after signing in from Home
• Web Client: Can be installed as an app in supporting browsers
• Web Client: Uploads continue while browsing other pages, with grouped progress and controls to pause, resume, cancel and retry
• Web Client: Added upload history stored in the browser, with completion dates and recovery of interrupted uploads when access to the original file is available
• Web Client: Files, shared links, uploads and account sessions have table and timeline views, with a searchable date index
• Web Client: Navigation and preview layouts adapt to available space, keeping controls accessible on narrow screens; desktop sidebar expansion is remembered
• Web Client: Upload entire folders, including nested files and empty subfolders, by selecting or dropping them where supported
• Web Client: When a file already exists, choose whether to replace it or resume its upload. Choices can apply to the whole upload batch
• Web Client: File lists now identify symbolic links and shared files and directories
• Web Client: Move files and folders individually or in groups using a destination picker, or move an item by entering a destination path when renaming
• Web Client: Improved dark-mode contrast for controls, links and selected items
• Web Client: Added audio playback and seeking in audio and video previews without downloading the entire file first
• Web Client: Improved file previews with keyboard navigation, syntax highlighting, clearer playback errors and updates after renaming or replacing files
• Web Client: Preview details show file formats, text encodings, sizes and modification times; UTF-16 text with a byte-order mark displays correctly
• Web Client: Added Compact interface density, with smaller icons and tighter spacing while preserving text size; small screens use it automatically
• Web Client: Administrators can enable browser caching of files accessed while signed in. Caching is disabled by default because copies may remain on the device after sign-out
• Web Client: Added an account page to view active sessions and end them remotely
• Web Client: Added controls to copy, edit, delete and temporarily disable shared links. Editing or re-enabling a link preserves its URL
• Web Client: Shared links can optionally identify their owner to recipients
• Web Client: Public file sharing can now be controlled globally and per user or group
• Web Client: Added browsable REST API documentation with search, examples and descriptions of request and response formats
• Web Client: Administrators can publish Markdown pages with customizable navigation and offer files for download. Built-in help and an optional example site are included
• Web Client: Public pages support rich Markdown, embedded files and media, and customizable layouts
• Web Client: Added an always-accessible Copyright and License page with the software license and third-party notices

Bugfixes and minor changes:

• FTP: Fixed MLST and MLSD permission facts being sent as "perms" instead of the standard "perm", preventing clients from recognizing advertised permissions
• Directory listings retain unavailable mounts with unknown metadata instead of failing the entire listing
• UI: Improved dialog positioning, spacing and font scaling
• Fixed transfers potentially being reported as complete before files had finished being written and closed
• Fixed connections potentially stalling while sending data or closing
• Fixed potential login failures caused by invalid data in pending authentication requests
• Fixed a user's group membership potentially being applied more than once
• The %<home> placeholder now requires accessing files with the system account's permissions (filesystem impersonation), not just using that account to sign in; otherwise its home directory may be unavailable
• Fixed handling of certificate chains and user-provided certificate paths
• Fixed inherited mount paths and permissions not updating when overridden by user or group settings
• Fixed misleading errors when automatically creating mount-point directories that already exist
• TLS: Fixed misleading errors when clients disconnect during connection setup
• TLS: Fixed missing client addresses in connection throttling logs
• FTP: Fixed failed or stalled passive-mode transfers and cancellation while resolving the server's address
• FTP: Fixed the response code sent at the end of a STAT directory listing
• FTP: Transfer error messages now distinguish socket reads and writes and no longer describe an unknown error source as a file-write failure
• FTP: Fixed LIST and STAT showing full paths instead of file names when requesting information about individual files
• Web Client: Resumed downloads check that the file has not changed, avoiding a mix of data from different versions
• UI: Banning an IP from an expanded transfer now targets that transfer's source address
• UI: Session protocol names now indicate whether the connection is encrypted
• UI: The session list no longer jumps to another scroll position when sessions are added or removed
• UI: Path validation errors now give relevant guidance, and invalid mount paths remain available for correction instead of reverting to the previous value
• UI: Fixed a crash when hovering over sessions immediately after connecting
• UI: Added warnings when the server cannot access files or load the home directory using the selected system account
• UI: Fixed duplicated users retaining the original identity and a crash when removing users or groups
• Web Client: Fixed handling of spaces in form fields, including credentials and shared paths
• Web Client: Fixed outdated sign-in status and requests failing when the login session needs to be renewed
• Web Client: Warn before leaving unfinished operations and offer to reload the app after a server update
• Web Client: Reduced application download sizes
• Web Client: Fixed the upload form not appearing in Firefox
• Web Client: Downloads use the browser's download manager, with a separate Save as... action where supported
• Web Client: File lists now refresh reliably after changes to files and folders
• Web Client: Clearer file-operation errors with readable resource paths
• Web Client: Common file and shared-link actions are available directly on rows when space permits
• Web Client: Shared links follow files and folders renamed or moved through the Web Client, and are disabled if an affected change fails

Bugfixes and minor changes:

• macOS: Work around a bug in macOS 27 where setting the locale to non-English triggers crashes in AppKit
• SFTP: Improved heuristic when keyboard-interactive requests are treated as a simple password prompt on servers not offering the password authentication method

New features:

• FTP(S), SFTP: Entering an empty path in the remote path edit field now returns back to the initial home directory

Bugfixes and minor changes:

• FTP(S): Fix parsing of permissions for chmod dialog on servers that include both perms and unix.mode facts in MLSD output
• SFTP: Updated fzssh to 1.4.0 to support additional algorithms and key file formats
• Official binaries are now linked against wxWidgets 3.2.11
• FTP(S): Fixed parsing of paths on servers with the server type set to DOS. Some malformed paths were wrongly accepted, confusing the engine; such paths are now rejected early.
• Refactored engine internals to remove influences from FTP-specific concepts that were permeating into other protocols

New features:

• SFTP: Added compatibility flag to Site Manager to ignore invalid bits in file attributes flags received from non-compliant servers

Bugfixes and minor changes:

• SFTP: Updated to fzssh 1.3.0
• Updated to libfilezilla 0.56.1
• Removed autodetection of FTP server type governing the remote path syntax. Exotic server types now need to be set explicitly on the advanced page in the Site Manager

Fixed vulnerabilities:

• Official binaries are now linked against GnuTLS 3.8.13

New features:

• SFTP: Added a page with compatibility flags to the Site Manager

Bugfixes and minor changes:

• SFTP: Updated to fzssh 1.2.1 to ignore items with invalid names directory listings instead of failing listings completely
• SFTP: Fixed issue where some items were reported with the wrong type depending on server capabilities
• SFTP: If keyboard-interactive authentication fails, automatically start a new authentication attempt

Fixed vulnerabilities:

• Official binaries are now linked against GnuTLS 3.8.13

Bugfixes and minor changes:

• UI: Fixed a crash during configuration export

Bugfixes and minor changes:

• Updated to libfilezilla 0.55.4 to address a crash
• SFTP: Updated to fzssh 1.2.0

Bugfixes and minor changes:

• SFTP: Added a heuristic to reply to a keyboard-interactive request with the site's password, if it consists of a single prompt named "Password"
• SFTP: Updated to fzssh 1.1.10 for increased compatibility with broken servers that blatantly violate the SSH specifications

Bugfixes and minor changes:

• SFTP: Updated to fzssh 1.1.9 to address an issue with servers sending nonsensical SSH_MSG_USERAUTH_INFO_REQUEST packages

Bugfixes and minor changes:

• SFTP: Updated to fzssh 1.1.8 to address an issue with servers sending empty longnames
• SFTP: Updated to fzssh 1.1.8 to address an issue with servers incapable of handling large receive windows of 2^32 - 1 bytes
• SFTP: Fixed an issue creating directories during file upload

Bugfixes and minor changes:

• Replacing of invalid characters in filenames when downloading can no longer be disabled
• If saving of password was disabled, temporarily remembering passwords until FileZilla gets closed could result in additional password prompts
• SFTP: Fix accessing symbolic links
• FileZilla is now distributed under the terms of the GPL version 3 or later (formerly version 2 or later)

Bugfixes and minor changes:

• SFTP: Updated fzssh to 1.1.7 to address corrupted uploads

Bugfixes and minor changes:

• Updated fzssh to 1.1.6 to improve SSH channel window handling

Bugfixes and minor changes:

• FTP: Fixed a crash when transfers are aborted

New features:

• SFTP support is now based on the fzssh library

Bugfixes and minor changes:

• Fix detection of OTP requests from FileZilla Pro Enterprise Server if using non-default FTP encryption options
• MSW: Improve handling of volumes mounted as path instead of as drive letter
• *nix, macOS: Remove custom send buffer option, rely on operating system auto-tuning

Bugfixes and minor changes:

• FTP: Fixed path display in NSLT output

Fixed vulnerabilities:

• Official binaries are now linked against GnuTLS 3.8.12

Fixed vulnerabilities:

• Official binaries are now linked against GnuTLS 3.8.12

Bugfixes and minor changes:

• Improved parallelization of concurrent authentication requests to increase performance
• Don't complain about missing or empty configuration files when reloading the configuration. Default values will be used in that case.
• Fix Let's Encrypt® well-known path normalization to preserve native format.
• FTP: Fixed a crash if both control and data connection fail at the same time

Bugfixes and minor changes:

• FTP: Fix a crash processing the ABOR command
• MSW: silent installations now automatically back up configuration files in cases where the interactive installer would prompt the user to do so.

Bugfixes and minor changes:

• FTP: do not use the default impersonator during the test of the FTP connections.
• Fixed bug that reversed mount point precedence, giving priority to group mount points over user ones; user mount points now correctly take precedence.
• Fixed bug that made the %<home> placeholder not work in case "Use system credentials to log in" was selected but "Use system credentials also for accessing &files and directories" was not.

Bugfixes and minor changes:

• macOS: Fixed issue with toolbar size

Bugfixes and minor changes:

• Fixed an issue whith the certificate verification dialog not becoming scrollable on certificates with many subject alternative names
• Updated to libfilezilla 0.52.0

New features:

• UI: Added a new choice when removing groups that are still in use, now the affected users can be removed regardless of other group membership as well
• UI: Small usability improvements to the group membership picker

Bugfixes and minor changes:

• Fixed a crash if editing a user while they are logged in
• Fixed listing the available mounts in the root directory if the root itself is not a defined mount point
• UI: Fixed a crash when adding or removing groups

Bugfixes and minor changes:

• Fixed a crash if loading a custom X.509 private key or certificate fails using implicit FTP over TLS

New features:

• Support a "write only" mode for the mount points.
• Added the --version option to the server.
• FTP: Added support for wildcard patterns (`*` and `?`) in LIST, NLST, MLSD, and STAT commands, with matching semantics identical to those used on Windows. This feature is available on all platforms and is disabled by default. It can be enabled per session using `OPTS filezilla.wildcards=1`; support is advertised via the FEAT command. For reference on matching behavior, see: https://learn.microsoft.com/en-us/archive/blogs/jeremykuhne/wildcards-in-windows
• MSW: Added support for specifying credentials for UNC paths in the mount list. Credentials can be configured via the Administration Interface under Rights Management -> Windows Share Credentials.

Bugfixes and minor changes:

• Fixed edge case in paths normalization

New features:

• For files and directories that are symbolic links, a small overlay symbol is now shown on icons in local file list and directory tree

Bugfixes and minor changes:

• Fixed an issue showing attributes of symbolic links in local file list

Bugfixes and minor changes:

• Fixed a crash if using impersonation
• Fixed a resource consumption issue in the impersonator

Fixed vulnerabilities:

• Official binaries are now linked against GnuTLS 3.8.10

Bugfixes and minor changes:

• FTP: Retry from a different source port if establishing a data connection in passive mode fails with EADDRINUSE

Fixed vulnerabilities:

• Official binaries are now linked against GnuTLS 3.8.10

Bugfixes and minor changes:

• Fixed a crash if using speed limits