Webmasters Stack Exchange is a question and answer site for pro webmasters. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Windows Thumbs.db system files that are in most of folders were uploaded with all other files from the localhost to the server.

Is it dangerous, if you forget to delete them on the server?

I am on shared hosting running *nix and Apache server.

share|improve this question

migrated from stackoverflow.com Oct 26 '11 at 9:40

This question came from our site for professional and enthusiast programmers.

Not programming. I see no code. – leppie Oct 25 '11 at 4:57

There is no direct threat from having Thumbs.db uploaded, even if people were able to download them they wouldn't get any information worth having.

It does maybe highlight an issues with your upload process though, this is one of the reasons why FTP is an inefficient way to upload files, extra files that you may not have intended to upload will go up.

share|improve this answer

Thumbs.db just contains thumbnail information for images. That way when you are browsing with file explorer you can quickly see them. It is not dangerous. It can safely be deleted or ignored.

share|improve this answer

I still think this file can be threat in some cases.

e.g.: it is a security hole when you don't want everyone to know the full image list you have in specific directory the Thumbs.db compromises this information. It stores information about the file names, modification times, thumbnail images can be fetched from it as well.

share|improve this answer

I wouldn't say that they're dangerous. The thumbs.db file is just an auto-generated file used for caching thumbnails.

It's a real pain to delete the thumbs.db because it will keep regenerating and it tends to be locked, so I would suggest writing some logic to exclude hidden files altogether.

share|improve this answer
I wouldn't exclude hidden files because then .htaccess might not get uploaded. – Toby Oct 30 '11 at 22:28
Thumbs.db is a Windows system file, and .htaccess isn't hidden on Windows(that I've ever seen). Dot files being hidden is a *nix convention, generally. – Su' Oct 31 '11 at 9:13

I do not agree with the other answers. In some cases this is a low security risk but it could have a hugh impact. It is similar to allow directory browsing.

The attacker gets a list of file names that could be really bad if you think about a page like Facebook where images are pseudo hidden by there name.

If there would be a Thumbs.db in this folder you would get profile images and Facebook IDs of a few hundred users: https://fbcdn-profile-a.akamaihd.net/hprofile-ak-ash3/c170.50.621.621/s160x160/.

If there would be a Thumbs.db in every folder you could easily access all images and Facebook IDs of every single user. Using the ID you can query real names for every image, too. That would be hugh!

Also keep in mind that Thumbs.db are not updated by the server. So it it possible data of deleted images, too.

I would advice to delete all Thumbs.db from the web server. They do not belong there, they do not have any use, but they could be a risk.

share|improve this answer

Not it's not really dangerous, as the file is only used by Windows Explorer for the thumbnail cache: http://en.wikipedia.org/wiki/Windows_thumbnail_cache.

But I would advise you to not leave only unnecessary files on your server and to delete them when you switch to production mode.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.