EIP-2026-118788

This is a writeup describing an information leakage vulnerability in Microsoft IIS 3.0 upgraded to IIS 4.0. The vulnerability allows unauthenticated access to the `bdir.htr` script, which can disclose directory structure information.