Security Vulnerability Alert – 13/08/2026

One of our third-party suppliers, Telerik, has notified us of a potential security vulnerability affecting RadEditor, a Telerik control used in some versions of LeavePlanner. Telerik has advised that, in affected configurations, this vulnerability could allow an unauthenticated attacker to gain access to the web hosting server. The attacker does not need to be logged in to LeavePlanner.

We have therefore removed RadEditor from the LeavePlanner application and replaced it with a Javascript based editor. The RadEditor was only used in the sysadmin MessageTemplate editor.

We strongly advise all Enterprise customers to update to the latest version of LeavePlanner as soon as possible to remove this risk from their installations.

The latest version can be downloaded from here https://help.leaveaplanner.com/downloads/LeavePlannerEnterprise.zip

If an upgrade is not immediately possible, or your Enterprise licence is out of support, we recommend applying the mitigation steps below as soon as possible.

Telerik RadAsyncUpload Mitigation Guidance

Guidance for Enterprise installations where an upgrade is not immediately available.

Important: These steps are risk-reduction measures, not a permanent vendor-supported fix. The preferred remediation is to upgrade to the latest version of LeavePlanner Enterprise Edition which has replaced this control completely.
 

Who Should Apply This

Apply this guidance if your installation cannot immediately be upgraded or patched. The steps below cover mitigation steps plus an additional handler block to reduce direct exposure of the upload endpoint.

This handler block will prevent uploading of a new logo within the organisation detail page, and also prevent you from importing from Excel files

Before You Start

  • Take a backup of the application folder and the current web.config and app.config.
  • Make the change during a maintenance window if possible. Saving web.config normally restarts the ASP.NET application.

Mitigation Step – Update web.config in the root of the website

Open the web.config file in the root of your LeavePlanner installation in a text editor, e.g. Notepad++, and make the following changes:

<system.web>
  <httpHandlers>
    <!-- Remove or comment the following line -->
    <add path="Telerik.Web.UI.DialogHandler.aspx" type="Telerik.Web.UI.DialogHandler" verb="*" validate="false" />
  </httpHandlers>
</system.web>
<system.webServer>
  <handlers>
    <!-- Ensure you have this line -->
    <remove name="Telerik_Web_UI_DialogHandler_aspx" />
    <!-- Remove the following line -->
    <add name="Telerik_Web_UI_DialogHandler_aspx" path="Telerik.Web.UI.DialogHandler.aspx" type="Telerik.Web.UI.DialogHandler" verb="*" preCondition="integratedMode" />
  </handlers>
</system.webServer>

These instructions are intended to reduce exposure for installations that cannot immediately be upgraded. They do not replace a supported application release that removes the vulnerable upload functionality.

Document version: 1.0