Is it dangerous to keep Thumbs.db on a web server?

Question

Windows Thumbs.db system files that are in most of folders were uploaded with all other files from the localhost to the server.

Is it dangerous, if you forget to delete them on the server?

I am on shared hosting running *nix and Apache server.

Thank you.

Answer 1

There is no direct threat from having Thumbs.db uploaded, even if people were able to download them they wouldn't get any information worth having.

It does maybe highlight an issues with your upload process though, this is one of the reasons why FTP is an inefficient way to upload files, extra files that you may not have intended to upload will go up.

Answer 2

Thumbs.db just contains thumbnail information for images. That way when you are browsing with file explorer you can quickly see them. It is not dangerous. It can safely be deleted or ignored.

Answer 3

I wouldn't say that they're dangerous. The thumbs.db file is just an auto-generated file used for caching thumbnails.

It's a real pain to delete the thumbs.db because it will keep regenerating and it tends to be locked, so I would suggest writing some logic to exclude hidden files altogether.

Answer 4

Not it's not really dangerous, as the file is only used by windows explorer for the thumnail cache

http://en.wikipedia.org/wiki/Windows_thumbnail_cache

But I would advise you to not leave only unnecessary files on your server and to delete them when you switch to production mode.

Answer 5

I still think this file can be threat in some cases.

E.g. it is a security hole when you don't want everyone to know the full image list you have in specific directory the Thumbs.db compromises this information. It stores information about the file names, modification times, thumbnail images can be fetched from it as well.