[Solved] Breaking Regression issue in 2026.2.708.462 for RadAsyncUpload security vulnerability fix

[Shawn]

After receiving the email from Progress titled "Action Required: Security Vulnerabilities for Telerik UI for ASP.NET AJAX" regarding a security vulnerability in the RadAsyncUpload control, I updated my nuget packages to the latest version:  2025.3.812.462 --> 2026.2.708.462.  Everything else in the update is working successfully except for any page in which the RadAsyncUpload control lives.  

When the page loads, I receive the following error:

Type : System.NullReferenceException, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
Message : Object reference not set to an instance of an object.
Source : Telerik.Web.UI
Help link : 
Data : System.Collections.ListDictionaryInternal
TargetSite : Void DescribeComponent(Telerik.Web.UI.IScriptDescriptor)
HResult : -2147467261
Stack Trace :    at Telerik.Web.UI.RadAsyncUpload.DescribeComponent(IScriptDescriptor descriptor)
   at Telerik.Web.UI.ScriptRegistrar.GetScriptDescriptors(Control control)
   at Telerik.Web.UI.RadWebControl.GetScriptDescriptors()
   at System.Web.UI.ScriptControlManager.RegisterScriptDescriptors(IScriptControl scriptControl)
   at Telerik.Web.UI.RadWebControl.RegisterScriptDescriptors()
   at Telerik.Web.UI.RadWebControl.Render(HtmlTextWriter writer)
   at System.Web.UI.Control.RenderControlInternal(HtmlTextWriter writer, ControlAdapter adapter)
   at System.Web.UI.Control.RenderChildrenInternal(HtmlTextWriter writer, ICollection children)
   at System.Web.UI.Control.RenderControlInternal(HtmlTextWriter writer, ControlAdapter adapter)
   at System.Web.UI.Control.RenderChildrenInternal(HtmlTextWriter writer, ICollection children)
   at System.Web.UI.HtmlControls.HtmlContainerControl.Render(HtmlTextWriter writer)
   at System.Web.UI.Control.RenderControlInternal(HtmlTextWriter writer, ControlAdapter adapter)
   at System.Web.UI.Control.RenderChildrenInternal(HtmlTextWriter writer, ICollection children)
   at System.Web.UI.HtmlControls.HtmlTableRow.RenderChildren(HtmlTextWriter writer)
   at System.Web.UI.HtmlControls.HtmlContainerControl.Render(HtmlTextWriter writer)
   at System.Web.UI.Control.RenderControlInternal(HtmlTextWriter writer, ControlAdapter adapter)
   at System.Web.UI.Control.RenderChildrenInternal(HtmlTextWriter writer, ICollection children)
   at System.Web.UI.HtmlControls.HtmlTable.RenderChildren(HtmlTextWriter writer)
   at System.Web.UI.HtmlControls.HtmlContainerControl.Render(HtmlTextWriter writer)
   at System.Web.UI.Control.RenderControlInternal(HtmlTextWriter writer, ControlAdapter adapter)
   at System.Web.UI.Control.RenderChildrenInternal(HtmlTextWriter writer, ICollection children)
   at System.Web.UI.HtmlControls.HtmlForm.RenderChildren(HtmlTextWriter writer)
   at System.Web.UI.HtmlControls.HtmlContainerControl.Render(HtmlTextWriter writer)
   at System.Web.UI.Control.RenderControlInternal(HtmlTextWriter writer, ControlAdapter adapter)
   at System.Web.UI.HtmlControls.HtmlForm.RenderControl(HtmlTextWriter writer)
   at System.Web.UI.Control.RenderChildrenInternal(HtmlTextWriter writer, ICollection children)
   at System.Web.UI.Control.RenderControlInternal(HtmlTextWriter writer, ControlAdapter adapter)
   at System.Web.UI.Control.RenderChildrenInternal(HtmlTextWriter writer, ICollection children)
   at System.Web.UI.Page.Render(HtmlTextWriter writer)
   at System.Web.UI.Control.RenderControlInternal(HtmlTextWriter writer, ControlAdapter adapter)
   at Telerik.Web.UI.RadAjaxControl.RenderPageInAjaxMode(HtmlTextWriter writer, Control page)
   at System.Web.UI.Control.RenderChildrenInternal(HtmlTextWriter writer, ICollection children)
   at System.Web.UI.Page.Render(HtmlTextWriter writer)
   at System.Web.UI.Control.RenderControlInternal(HtmlTextWriter writer, ControlAdapter adapter)
   at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)

Another application updated to the latest version using the RadAsyncUpload works perfectly fine.  After researching, I discovered that my "broken" application is session-less, and my other application (which updated successfully) had no issues whatsoever.  In the previous version, 2025.3.812.462, RadAsyncUpload worked perfectly with a session-less application.  I've since had to implement session in order to resolve both the page load issue and the security vulnerability for the RadAsyncUpload.

 

[JP]

We also just updated and ran into the same issue. We also have session state disabled. This needs to be prioritized.

[Attila Antal]

Hello Shawn,

Thank you for reporting the issue. This is a regression we introduced earlier this year. We have received a report earlier about the same and we were able to fix it promptly, see Disabling session state and csrf causes null reference exception when using async upload.

Due to the nature of the issue, I'm afraid I can't offer a workaround that allows using the AsyncUpload control without having the Session state enabled. I can recommend enabling the Session until the next release. If you choose to downgrade, please be sure to apply the Security mitigations as earlier versions have some known vulnerabilities. Should you choose this path, let us know and we'll assist you further.

Please excuse us for any inconvenience this may have caused.

Regards,
Attila Antal
Progress Telerik

[Shawn]

Attila,

I've just updated to the recent version that is supposed to contain the session fix.  I've upgraded to version 2026.3.812.462 this morning.  I then re-updated my web.config to turn session state back off.  I no longer received the Null Reference Error, however in my client script, after the file has been temporarily uploaded and I press the Save button on my form, my client validation script ensuring a file has been "temporarily" selected shows that no files have been uploaded. 

function validateAttachment(src, args) {
    debugger;

    if (<%= IsNewAdd.ToString().ToLower() %>) {
        // Attachments are required...check the control
        var asyncUpload = $find("<%= radIntUpload.ClientID %>");
        args.IsValid = (asyncUpload.getUploadedFiles().length > 0);
    }
}

The value of length is zero.

When I re-enable session, everything works as expected. Is session still required for the upload control or is there something else that's missing or that I'm missing?

Thanks...Shawn

[Attila Antal]

Hi Shawn,

I am assuming you're using a custom Validator which calls the validateAttachment method when you click the Save button to perform a PostBack. I am testing this scenario with the Telerik UI for ASP.NET AJAX version 2026.3.812.462, with CSRF disabled, and SessionState Off/On. The component seems to be working.

This is the markup code of what I have tested

<telerik:RadAsyncUpload ID="radIntUpload" runat="server" TargetFolder="~/Uploads" PostbackTriggers="RadButton1">
</telerik:RadAsyncUpload>

<asp:CustomValidator ID="CustomValidator1" runat="server" ErrorMessage="CustomValidator" ClientValidationFunction="validateAttachment">
</asp:CustomValidator>
        
<telerik:RadButton runat="server" ID="RadButton1" Text="Save" AutoPostBack="true" />

<script>
    const validateAttachment = function (src, args) {
        var asyncUpload = $find("<%= radIntUpload.ClientID %>");

        args.IsValid = (asyncUpload.getUploadedFiles().length > 0);

        console.log("Uploaded files length: ", asyncUpload.getUploadedFiles().length);
        console.log("IsValid", args.IsValid);

        debugger;
    }
</script>

In the web config I added

<appSettings>
	<add key="Telerik.AsyncUpload.EnableCsrfValidation" value="false" />
</appSettings>

I also tested disabling the session state

<system.web>
	<sessionState mode="Off" />

 

This is the result

If this is not the same scenario, please clarify so we can try and replicate the issue. Based on that I would be able to tell the next steps.

I look forward to hearing from you.