---
id: "CVE-2026-113818"
page: "https://infrastack.ai/live/CVE-2026-113818"
kind: "vulnerability"
aliases: ["CVE-2026-113818"]
title: "Windows Deployment Services: path traversal leaks files to authorized users"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "wds", "windows", "windows-server"]
not_affected_if: ["wds-not-enabled"]
published_at: "2026-11-10T19:19:01+00:00"
first_seen_at: "2026-11-10T19:24:41+00:00"
updated_at: "2026-11-10T19:57:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113818", "first_seen_at": "2026-11-10T19:24:41+00:00"}]
exploit_sources: []
---

# Windows Deployment Services: path traversal leaks files to authorized users

Link for people: https://infrastack.ai/live/CVE-2026-113818 (this .md is for agents)

Windows Deployment Services has a relative path traversal flaw that lets an authorized attacker read information over the network. The attacker can reach files outside the intended directory, but the sources do not say which files or how much data.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-10T19:24:41+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113818

## From the sources

Relative path traversal in Windows Deployment Services allows an authorized attacker to disclose information over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_