On the website of the company I am working for are files, which can be downloaded. On the page, where you can download that file, you can also see the full path on the server itself of the file, e.g. /var/www/homepage/path/to/downloadable/file. This seems to be like an information next to the download link of that file.

The link of the downloadable file is handled by a download manager. So when you go to the download link of that file, you'll see something like http://page/download/?downmanid=[number]&ind=[bigRandomAlphaNumValue]. This [bigRandomAlphaNumValue] seems to be a sort of check. You cannot download the file, if you change that value.

But now from a security perspective: What to do about this full internal path of that downloadable file? Should I be concerned?

  • Eh, maybe a little. Are you worried the folder structure will provide valuable information to a hacker who is trying to access your system? What sort of stuff is in the folder tree? – John Wu Mar 15 '17 at 11:34
  • 1
    It is unnecessary information, so it should be removed by principle. However, it's unlikely to be a security risk (from the information you gave). If, however, you can download any file on the server, this would be a huge security vulnerability. – A. Hersean Mar 15 '17 at 12:34

I think you should be concerned. It discloses information about the server hosting your company website. For instance, depending on the path it may contain unix usernames or give hints on how to exploit any path traversal vulnerability found in the website.

There is any reason to show the full path to the file? Why not just the filename?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.