5

Windows Thumbs.db system files that are in most of folders were uploaded with all other files from the localhost to the server.

Is it dangerous, if you forget to delete them on the server?

I am on shared hosting running *nix and Apache server.

Improve this question
1
  • 1
    Not programming. I see no code.
    – leppie
    Oct 25, 2011 at 4:57

6 Answers 6

Reset to default
8

There is no direct threat from having Thumbs.db uploaded, even if people were able to download them they wouldn't get any information worth having.

It does maybe highlight an issues with your upload process though, this is one of the reasons why FTP is an inefficient way to upload files, extra files that you may not have intended to upload will go up.

Improve this answer
4

Thumbs.db just contains thumbnail information for images. That way when you are browsing with file explorer you can quickly see them. It is not dangerous. It can safely be deleted or ignored.

Improve this answer
3

I still think this file can be threat in some cases.

e.g.: it is a security hole when you don't want everyone to know the full image list you have in specific directory the Thumbs.db compromises this information. It stores information about the file names, modification times, thumbnail images can be fetched from it as well.

Improve this answer
2

I wouldn't say that they're dangerous. The thumbs.db file is just an auto-generated file used for caching thumbnails.

It's a real pain to delete the thumbs.db because it will keep regenerating and it tends to be locked, so I would suggest writing some logic to exclude hidden files altogether.

Improve this answer
2
  • 1
    I wouldn't exclude hidden files because then .htaccess might not get uploaded.
    – Toby
    Oct 30, 2011 at 22:28
  • 1
    Thumbs.db is a Windows system file, and .htaccess isn't hidden on Windows(that I've ever seen). Dot files being hidden is a *nix convention, generally.
    – Su'
    Oct 31, 2011 at 9:13
2

I do not agree with the other answers. In some cases this is a low security risk but it could have a hugh impact. It is similar to allow directory browsing.

The attacker gets a list of file names that could be really bad if you think about a page like Facebook where images are pseudo hidden by there name.

If there would be a Thumbs.db in this folder you would get profile images and Facebook IDs of a few hundred users: https://fbcdn-profile-a.akamaihd.net/hprofile-ak-ash3/c170.50.621.621/s160x160/.

If there would be a Thumbs.db in every folder you could easily access all images and Facebook IDs of every single user. Using the ID you can query real names for every image, too. That would be hugh!

Also keep in mind that Thumbs.db are not updated by the server. So it it possible data of deleted images, too.

I would advice to delete all Thumbs.db from the web server. They do not belong there, they do not have any use, but they could be a risk.

Improve this answer
1

Not it's not really dangerous, as the file is only used by Windows Explorer for the thumbnail cache: http://en.wikipedia.org/wiki/Windows_thumbnail_cache.

But I would advise you to not leave only unnecessary files on your server and to delete them when you switch to production mode.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.