diff --git a/frontend/src/models/DirectoryModel.js b/frontend/src/models/DirectoryModel.js
index 03107d94d..af1576263 100644
--- a/frontend/src/models/DirectoryModel.js
+++ b/frontend/src/models/DirectoryModel.js
@@ -67,14 +67,43 @@ export function createDirectoryModel(origin, accessToken, api) {
 
       return result.body.entries;
     },
-    upload(targetDir, file, progressHandler) {
+    async upload(targetDir, file, progressHandler) {
       // file may contain a file name or a file path + file name
       const relativefilePath = (file.webkitRelativePath ? file.webkitRelativePath : file.name);
 
-      return superagent.post(`${origin}/api/v1/${api}/files/${encodeURIComponent(sanitize(targetDir + '/' + relativefilePath))}`)
-        .query({ access_token: accessToken })
-        .attach('file', file)
-        .on('progress', progressHandler);
+      const req = new Promise(function (resolve, reject) {
+        var xhr = new XMLHttpRequest();
+
+        xhr.addEventListener('load', () => {
+          if (xhr.status >= 200 && xhr.status < 300) {
+            resolve(xhr.response);
+          } else {
+            reject({
+              status: xhr.status,
+              statusText: xhr.statusText
+            });
+          }
+        });
+        xhr.addEventListener('error', () => {
+          reject({
+            status: xhr.status,
+            statusText: xhr.statusText
+          });
+        });
+        xhr.upload.addEventListener('progress', (event) => {
+          if (event.loaded) progressHandler({ direction: 'upload', loaded: event.loaded});
+        });
+
+        xhr.open('POST', `${origin}/api/v1/${api}/files/${encodeURIComponent(sanitize(targetDir + '/' + relativefilePath))}?access_token=${accessToken}`);
+
+        xhr.setRequestHeader('Content-Type', 'application/octet-stream');
+        xhr.setRequestHeader('Content-Length', file.size);
+
+        xhr.send(file);
+      });
+
+      console.log('was passiert?')
+      const res = await req;
     },
     async newFile(folderPath, fileName) {
       await superagent.post(`${origin}/api/v1/${api}/files/${folderPath}`)
@@ -82,9 +111,7 @@ export function createDirectoryModel(origin, accessToken, api) {
         .attach('file', new File([], fileName));
     },
     async newFolder(folderPath) {
-      await superagent.post(`${origin}/api/v1/${api}/files/${folderPath}`)
-        .query({ access_token: accessToken })
-        .send({ directory: true });
+      await superagent.post(`${origin}/api/v1/${api}/files/${folderPath}?access_token=${accessToken}&directory=true`);
     },
     async remove(filePath) {
       await superagent.del(`${origin}/api/v1/${api}/files/${filePath}`)
diff --git a/src/infra_version.js b/src/infra_version.js
index 8ef24690d..62ff547b1 100644
--- a/src/infra_version.js
+++ b/src/infra_version.js
@@ -18,7 +18,7 @@ exports = module.exports = {
         'mysql': 'registry.docker.com/cloudron/mysql:3.4.2@sha256:379749708186a89f4ae09d6b23b58bc6d99a2005bac32e812b4b1dafa47071e4',
         'postgresql': 'registry.docker.com/cloudron/postgresql:5.2.3@sha256:de56fafa270f867ef3cec7824a83a46fade33dd3a3a35e4e011929b6cdaaf284',
         'redis': 'registry.docker.com/cloudron/redis:3.5.3@sha256:1e1200900c6fb196950531ecec43f400b4fe5e559fac1c75f21e6f0c11885b5f',
-        'sftp': 'registry.docker.com/cloudron/sftp:3.8.6@sha256:6b4e3f192c23eadb21d2035ba05f8432d7961330edb93921f36a4eaa60c4a4aa',
+        'sftp': 'registry.docker.com/cloudron/sftp:3.8.7@sha256:9d13007f665d72875e7e4830fc4d5ee352c7c1a44b4f0f526746e2c2d2c296e0',
         'turn': 'registry.docker.com/cloudron/turn:1.7.2@sha256:9ed8da613c1edc5cb8700657cf6e49f0f285b446222a8f459f80919945352f6d',
     }
 };