Recent Version History

• Translation completed: Czech.

• Experimental 64-bit version of WinSCP. 618
• Optionally not showing error message when connection is lost while idle. 2360
• SSH core and SSH private key tools (PuTTYgen and Pageant) upgraded to PuTTY 0.84.
  It brings the following change:
  • Security issue: fixed a remotely triggerable double-free in RSA key exchange. rsakex-double-free
  • Minor security issue: fixed a remotely triggerable crash in NIST ECDSA signature verification. ecdsa-remotely-triggerable-assertion
  • Bug fix: spurious “Network error: Socket is not connected” when authenticating to some HTTP proxies. http-proxy-auth-wsaenotconn
• TLS/SSL core upgraded to OpenSSL 3.5.7.
• XML parser upgraded to Expat 2.8.1.
• Restored faster C TLS/SSL AES implementation.
• Configurable warning when opening large file in an internal editor. 2437
• Informing that when preserving directory timestamps is enabled, using multiple connections for transfer is not possible. 2439
• Warning when pasting a session URL with unsafe settings.
• When opening session in PuTTY to a host for which WinSCP has multiple host keys cached, using the last key or the key that PuTTY has cached. 2440
• Always (re)registering drag&drop shell extension during installation, even when the extension is not replaced.
• Allowed Console interface tool to have .exe extension to avoid false positive detections by some antiviruses. 2434
• Using “username” and “hostname” as one word.
• Reading all system settings from 64-bit registry.
• Allow assigning null to Session.SessionLogPath. 2438
• Avoiding using SSH_FXF_EXCL together with SSH_FXF_TRUNC SFTP file opening flags. 2444
• Optimized file system monitoring when looking for dummy directory during drag&drop downloads. 2445
• Change: Not allowing WebDAV redirects to other hosts by default. 2447
• Change: Not allowing WebDAV redirects to an unencrypted URL by default. 2448
• Updated to JCL library 2.9 commit c669fd12.
• Bug fix: Failure when trying to connect via HTTP proxy to FTP host with excessively long login details. 2435
• Bug fix: Buffer overflow in Console interface tool. 2436
• Bug fix: Failure setting Session.DebugLogPath when running in impersonated context. 2441
• Bug fix: Message boxes from secondary windows (like the internal editor) caused application to move to the background when when the main window was minimized. 2443
• Bug fix: Heap over-read via crafted encrypted filename. 2449
• Bug fix: Slashes in filenames can cause path traversal when invalid filename characters replacement is disabled. 2450

• Support for OpenSSH ssh-agent. 1682
• Optionally connecting all workspace/folder sessions immediately. 1026
• Preserving panel scroll position after rename. 2425
• Ctrl+C works in list views on ‘Server and protocol information’ dialog.
• Preventing moving or copying a file or folder over ancestor folder with the same name. 2427
• WebDAV/HTTP core upgraded to neon 0.37.1.
• XML parser upgraded to Expat 2.7.5.
• Bug fix: Some menus were not working on displays to the left or above the primary display. 2423
• Bug fix: Mouse wheel downwards scrolling did not work on toolbar drop down lists.
• Bug fix: Once any control of permissions popup box was focused the popup no longer closed when user clicked outside of it.
• Bug fix: Failure when closing Transfer settings dialog with X button while a permissions popup box control is focused. 2420
• Bug fix: Failure when switching to a session that is being reconnected.
• Bug fix: Failure when the first bit of an SFTP response is set. 2422
• Bug fix: Copying to clipboard with Ctrl+C from ‘Server and protocol information’ was broken.
• Bug fix: Protocol additional information scrolling was broken.
• Bug fix: Master password dialog was missing Help button.
• Bug fix: Checking if edited/opened file was modified externally didn’t work for inactive sessions. 2426
• Bug fix: Wrapped settings values from Raw Site Settings dialog were not preserved.
• Bug fix: Some files modified by local custom command in SCP session fail to upload back. 2428
• Bug fix: Whole Key exchange page was incorrectly hidden when “Handles SSH key re-exchange badly” bug was enabled.
• Bug fix: Some message boxes leak GDI handle. 2430
• Bug fix: Login dialog leaks GDI handles. 2431

• Synchronizing two local directories. 2020
• Compiler upgraded to Clang/bcc32c. 618
• Inactive sessions can be automatically reconnected. 2232
• Added dark theme support to: 1696
  • Login dialog. 2345
  • Transfer Options dialog.
  • Message boxes.
  • Queue column headers. 2356
  • Progress window.
  • Authentication Progress window. 2358
  • Bug fix: Scrollbar colors did not always reflect the color theme
• Using modern directory selection dialog that scales correctly and allows creating new directory. 2373 2389
• Optimized GUI when working with large subdirectory selection. 2396
• Change: Default to UTF-8 encoding in internal editor. 2397
• New DigiCert EV code signing certificate valid until March 2029 is used for signing binaries.
• TLS/SSL core upgraded to OpenSSL 3.5.5.
• WebDAV/HTTP core upgraded to neon 0.36.0.
• XML parser upgraded to Expat 2.7.4.
• Installer upgraded to Inno Setup 6.7.0 with dark mode support enabled.
• Increased WinSCP memory limit to 4 GB. 2412
• Defined and implemented interface for the .NET library. By @mjkent. 856
• Optimized TLS/SSL AES implementation.
• Restoring ability to restart Explorer to allow upgrade of drag&drop shell extension, when installing for current user, as after-restart replacement is not possible without Administrator privileges. 2381
• MSI toolset updated to WiX 5.
• Commands to copy paths to the clipboard on the Synchronization checklist window.
• Cryptography optimization.
• Support long AWS/S3 session tokens. 2403
• Prevent hang when new device is attached or removed while some mapped network drive is not available. 2382
• Copy and paste improvements:
  • Consistently renaming local files dropped or pasted back to their source directory to avoid collisions.
  • Bug fix: When copying local files to clipboard from system context menu, “cut” state of previously cut files was not cleared.
• Not redundantly verifying WebDAV or S3 certificate in Windows Certificate store if it is already marked as trusted in session settings. 2404
• Provide SNI when opening FTP data connection. 2410
• Optimized synchronization checklist sorting.
• Support for Beyond Compare 5 in Compare Files extension. 2417
• Convert unsupported SSH proxy to SSH tunnel when importing site from PuTTY. 2408
• FTP directory listing falls back to the other active/passive mode, consistently with file transfers.
• Consistently calling command to open window with specific directory Explore, instead of sometimes Browse.
• Consistently referring to file last modification timestamp column as Date modified.
• With INI file provided on command-line, using the same INI file when starting a new instance.
• Windows shell local file copy status window is centered on the main window.
• Made taskbar flashing configurable in GUI. 2411
• Control labels on transfer settings dialogs do not show keyboard accelerator cue, until Alt key is pressed.
• Not using drag images even with directory trees. 1274
• Allow configuring checksum commands. 2394
• Updated to JCL library 2.8.1.
• Updating jump list only when running with GUI.
• Made space on permissions box for longer translations. 2398
• Opening Default Apps Settings page directly to open it in the foreground and avoid flashing Control Panel window.
• Improving order in which Windows Narrator reads window controls.
• All edit boxes with history consistently do not auto complete and show 16 entries in the drop down.
• Removed obsolete Preserve remote timestamp session settings.
• Bug fix: Local file with invalid characters replaced could not be explored from the Synchronization checklist window.
• Bug fix: Files modified by local custom command are not always uploaded to the correct remote directory. 2370
• Bug fix: List of network drives in drive drop down and directory tree did not always match.
• Bug fix: Host key prompt did not have the default button.
• Bug fix: When the local path specified on Open directory/Location profile dialog is not existing, when browsing for a new path, the trailing part of the nonexisting path was appended to the new path.
• Bug fix: Trying to enter an invalid link in local panel fails silently.
• Bug fix: After FTP data connection fails to open further use of the session is broken.
• Bug fix: Pasting cut files from the clipboard into a local panel copies them instead of moving them. 2400
• Bug fix: Some edits did not save their value to history when submitting with Enter.
• Bug fix: Too long edit history dropdown can overflow monitor bounds. 2432
• Bug fix: Message box texts and some control labels are not visible to screen readers. 2413
• Bug fix: Failure when clicking tab close button while the session is already being closed. 2416

• Translations completed: Croatian, Finnish, Georgian, Italian and Serbian.
• TLS/SSL core upgraded to OpenSSL 3.3.7.
• Back-propagated fixes from 6.6.2 beta release:
  • Bug fix: Failure setting Session.DebugLogPath when running in impersonated context. 2441
  • Security issue: fixed a remotely triggerable double-free in RSA key exchange. rsakex-double-free
  • Minor security issue: fixed a remotely triggerable crash in NIST ECDSA signature verification. ecdsa-remotely-triggerable-assertion
• Bug fix: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification. CVE-2026-45447 fix from OpenSSL 3.4.6.

• Translations completed: Macedonian, and updated: Lithuanian, and Russian.
• TLS/SSL core upgraded to OpenSSL 3.3.6.
• Back-propagated improvements from 6.6–6.6.1 beta release:
  • New DigiCert EV code signing certificate valid until March 2029 is used for signing binaries.
  • XML parser upgraded to Expat 2.7.5.
  • Support for Beyond Compare 5 in Compare Files extension. 2417
  • Bug fix: Checking if edited/opened file was modified externally didn’t work for inactive sessions. 2426

• Translation updated: Vietnamese.
• Bug fix: Pasting files using local directory tree context menu pastes them to the current directory, instead of the selected one.
• Bug fix: Failure when opening site imported from PuTTY with unsupported SSH proxy. 2407
• Bug fix: Incorrect hostname validation when connecting to S3 endpoint with certificate that does not cover root S3 hostname. 2409

• Translations updated: Belarusian and Georgian.
• TLS/SSL core upgraded to OpenSSL 3.3.5.
• XML parser upgraded to Expat 2.7.3.
• Added new ap-southeast-6 AWS region.
• Bug fix: When restored after operation completed while minimized the window is disabled. 2393
• Bug fix: Command md5sums is incorrectly used to calculate MD5 checksum instead of md5sum. 2392
• Bug fix: Incomplete FTP upload when the source stream/stdin reads less than requested. 2395
• Bug fix: Shift-clicking OK button on Synchronization checklist window when synchronization in the background was not possible still closed the window.
• Bug fix: Failure after reloading file panel when number of files decreases. 2402
• Bug fix: Failure or silently missing headers when when S3 request headers were too long.

• Translations updated: Belarusian, Brazilian Portuguese 2386 and Slovenian.
• TLS/SSL core upgraded to OpenSSL 3.3.4.
• Temporarily not updating drag&drop shell extension for minor changes when installing for current user. 2381
• Bug fix: Failure when reading empty certificate authority configuration.
• Bug fix: Failure when running Maximized. 2387
• Bug fix: Incorrect scaling of navigation tree on Login and Preferences dialogs. 2385
• Bug fix: Incorrect scaling of drag&drop shell extension status display on Preferences dialog.

• Translation updated: Brazilian Portuguese and Polish.
• Added new ap-east-2 AWS region.
• Bug fix: Some translations (notably Japanese) are not loaded. 2372
• Bug fix: Directory tree indentation is scaled incorrectly when starting on scaled display on system with scaled primary monitor. 2374
• Bug fix: Wrong icon size is used when starting on secondary monitor with different scaling than the primary one.
• Bug fix: Failure when proxy hostname resolution fails with SFTP/SCP protocols. 2376
• Bug fix: Avoid replacing %2F with a slash and %2E with a dot in special cases on upload to avoid path traversal. 2377
• Bug fix: Failure when canceling reconnection on authentication banner, when the connection was already closed by the server. 2379
• Bug fix: Local directories sometimes cannot be deleted. 2380

Older versions