Portable OpenSSH supports running on Cygwin. However, the SFTP client only filters out forward slashes (in do_lsreaddir()) and the directory names "." and ".." (in download_dir_internal()). On Windows, including in Cygwin, backslashes can a lso be used for directory traversal.
653080ead75f1a09ebf8449dc6271901603c629ff1cecc6eeb9ae0c1a78ce3da