Description
This advisory describes security fixes delivered across the FME Platform in November 2026. These fixes address vulnerabilities in Safe Software proprietary code. No evidence of exploitation of these vulnerabilities has been observed at the time of publication.
Safe Software recommends that affected users review the summary table below and carry out any necessary actions for your environment.
For the specific hotfix downloads, see the List of Patch Files by Release Version below.
Summary Table of Security Updates
| Vulnerability ID (CVE) | Category | Available for | Earliest affected FME Version | Impact | Severity (CVSS Level) | Severity (CVSS Score) | Resolution |
|---|---|---|---|---|---|---|---|
| Pending | Arbitrary File Overwrite (Zip-slip) | FME Flow | No lower limit | An authenticated user, or in certain configurations an unauthenticated user, may be able to write files outside the intended upload location, potentially leading to arbitrary code execution. | Critical | 9.2 | See FME Flow, or FME Flow Hosted Remediation |
| Pending | TCL Injection |
FME Form FME Flow |
No lower limit | A user submitting workspace parameters may be able to execute arbitrary operating system commands. | High | 7.7 | See FME Form, FME Flow, or FME Flow Hosted Remediation |
| Pending | TCL Injection |
FME Form FME Flow |
No lower limit | A user submitting workspace parameters may be able to disclose sensitive information or, in some cases, execute arbitrary code. | High | 7.7 | See FME Form, FME Flow, or FME Flow Hosted Remediation |
| Pending | TCL Injection |
FME Form FME Flow |
No lower limit | Processing a maliciously crafted data file may result in arbitrary code execution. | Critical | 9.2 | See FME Form, FME Flow, or FME Flow Hosted Remediation |
| Pending | TCL Injection |
FME Form FME Flow |
No lower limit | A user submitting workspace parameters or a malicious data file may be able to load and execute arbitrary code. | Critical | 9.2 | See FME Form, FME Flow, or FME Flow Hosted Remediation |
| Pending | TCL Injection |
FME Form FME Flow |
No lower limit | A user able to inject scripting expressions into workspace parameters may be able to execute operating system commands. | High | 7.7 | See FME Form, FME Flow, or FME Flow Hosted Remediation |
| Pending | TCL Injection |
FME Form FME Flow |
No lower limit | Even where direct command execution is blocked, a user may still be able to execute arbitrary code through alternate scripting channels. | High | 7.7 | See FME Form, FME Flow, or FME Flow Hosted Remediation |
| Pending | TCL Injection |
FME Form FME Flow |
No lower limit | A user submitting workspace parameters may be able to execute arbitrary code through a legacy scripting feature. | High | 7.7 | See FME Form, FME Flow, or FME Flow Hosted Remediation |
| Pending | TCL Injection |
FME Form FME Flow |
No lower limit | A user submitting workspace parameters may be able to execute arbitrary code through parameter substitution in workspace configuration. | High | 7.7 | See FME Form, FME Flow, or FME Flow Hosted Remediation |
| Pending | TCL Injection |
FME Form FME Flow |
No lower limit | Processing a maliciously crafted data file may result in arbitrary code execution. | Critical | 9.2 | See FME Form, FME Flow, or FME Flow Hosted Remediation |
| Pending | TCL Injection |
FME Form FME Flow |
No lower limit | Processing a maliciously crafted data file may result in arbitrary code execution. | Critical | 9.2 | See FME Form, FME Flow, or FME Flow Hosted Remediation |
| Pending | TCL Injection |
FME Form FME Flow |
No lower limit | A user submitting workspace parameters may be able to execute arbitrary code by bypassing parameter-encoding safeguards. | High | 7.7 | See FME Form, FME Flow, or FME Flow Hosted Remediation |
| Pending | TCL Injection |
FME Form FME Flow |
No lower limit | A user submitting workspace parameters may be able to execute arbitrary code through a scripting feature. | Critical | 9.2 | See FME Form, FME Flow, or FME Flow Hosted Remediation |
| Pending | TCL Injection, Python Injection |
FME Form FME Flow |
No lower limit | A user submitting a job through the platform's automation feature may be able to trigger arbitrary code execution by overriding internal server directives. | Critical | 9.2 | See FME Form, FME Flow, or FME Flow Hosted Remediation |
| Pending | OS Command Execution |
FME Form FME Flow |
No lower limit | A user submitting workspace parameters may be able to execute arbitrary operating system commands. | High | 7.7 | See FME Form, FME Flow, or FME Flow Hosted Remediation |
| Pending | OS Command Execution |
FME Form FME Flow |
No lower limit | A user submitting workspace parameters may be able to execute arbitrary operating system commands. | High | 7.7 | See FME Form, FME Flow, or FME Flow Hosted Remediation |
| Pending | OS Command Execution |
FME Form FME Flow |
No lower limit | A user submitting workspace parameters may be able to execute arbitrary operating system commands, even in workspaces not designed to accept command input. | High | 7.7 | See FME Form, FME Flow, or FME Flow Hosted Remediation |
| Pending | Python Exec |
FME Form FME Flow |
No lower limit | A user submitting workspace parameters may be able to execute arbitrary code, including operating system commands. | High | 7.7 | See FME Form, FME Flow, or FME Flow Hosted Remediation |
| Pending | Python Exec |
FME Form FME Flow |
No lower limit | Opening or running an untrusted workspace or configuration file may result in arbitrary code execution. | High | 7.5 | See FME Form, FME Flow, or FME Flow Hosted Remediation |
| Pending | SQL Injection |
FME Form FME Flow |
No lower limit | A user submitting workspace parameters or data may be able to manipulate database queries, potentially leading to unauthorized data access or code execution. | High | 7.7 | See FME Form, FME Flow, or FME Flow Hosted Remediation |
| Pending | Workspace |
FME Form FME Flow |
No lower limit | A user submitting workspace parameters may be able to inject code into a workspace's scripting logic. | High | 7.7 | See FME Form, FME Flow, or FME Flow Hosted Remediation |
| Pending | Parameter Injection |
FME Form FME Flow |
No lower limit | A user submitting job parameters may be able to override internal logging settings, potentially exhausting disk space and causing a denial of service. | High | 7.1 | See FME Form, FME Flow, or FME Flow Hosted Remediation |
| Pending | Data-Driven |
FME Form FME Flow |
No lower limit | Processing a maliciously crafted data file may result in arbitrary code execution. | Critical | 9.2 | See FME Form, FME Flow, or FME Flow Hosted Remediation |
| Pending | Data-Driven |
FME Form FME Flow |
No lower limit | Certain internal functions may allow unvalidated input to trigger arbitrary code execution. | Critical | 9.2 | See FME Form, FME Flow, or FME Flow Hosted Remediation |
| Pending | Data-Driven |
FME Form FME Flow |
No lower limit | Processing a maliciously crafted data file may result in arbitrary code execution. | Critical | 9.2 | See FME Form, FME Flow, or FME Flow Hosted Remediation |
| Pending | Workspace |
FME Form FME Flow |
No lower limit | A workspace using certain data-lookup transformers may be vulnerable to arbitrary code execution from attacker-controlled parameter or data values. | Critical | 9.2 | See FME Form, FME Flow, or FME Flow Hosted Remediation |
| Pending | Python Exec |
FME Form FME Flow |
No lower limit | A user submitting workspace parameters may be able to execute arbitrary code through a scripting feature. | Critical | 9.2 | See FME Form, FME Flow, or FME Flow Hosted Remediation |
| Pending | Network/TLS | FME Form | No lower limit | A network attacker may be able to intercept and tamper with encrypted network traffic, potentially exposing credentials or injecting malicious content. | High | 7.7 | See FME Form Remediation |
| Pending | Network/TLS | FME Form | No lower limit | A network attacker may be able to intercept single sign-on authentication tokens. | High | 7.4 | See FME Form Remediation |
| Pending | Network/TLS |
FME Form FME Flow |
No lower limit | A network attacker may be able to tamper with workspace configuration data in transit, potentially leading to arbitrary code execution. | High | 7.5 | See FME Form, FME Flow, or FME Flow Hosted Remediation |
| Pending | Data-Driven |
FME Form FME Flow |
No lower limit | Processing a maliciously crafted data file may lead to memory corruption and potential arbitrary code execution. | High | 7.7 | See FME Form, FME Flow, or FME Flow Hosted Remediation |
| Pending | Credentials |
FME Form FME Flow |
No lower limit | Enabling debug logging may cause credentials to be written to log files in plaintext. | Medium | 6 | See FME Form, FME Flow, or FME Flow Hosted Remediation |
| Pending | Credentials | FME Flow | No lower limit | An authenticated user may be able to exfiltrate authentication tokens or overwrite files outside the intended project location. | High | 7.1 | See FME Flow, or FME Flow Hosted Remediation |
| Pending | Parameter Injection |
FME Form FME Flow
|
No lower limit | A user submitting job parameters may be able to override internal server settings, potentially escalating privileges, impersonating other users, or redirecting server communications. | High | 7.6 | See FME Form, FME Flow, or FME Flow Hosted Remediation |
Recognition
Safe Software thanks Abley and con terra GmbH for responsibly reporting issues included in this advisory. We recognize their contribution to increasing the security standard of FME.
Impact
According to our assessment, all FME versions prior to those described as fixed or remediated according to the instructions in this article are affected.
Please keep in mind that our provided severity ratings do not take into account the details of your installation and are intended to be used as a guide only.
The risk may be elevated for instances exposed to the internet, such as those hosted on FME Flow Hosted or deployments of FME Flow that are publicly accessible. However, the applicability of the provided risk assessments should be evaluated within the context of your own IT environment.
Remediation
These updates (see the Summary Table) include fixes for vulnerabilities which we have assessed as having a notably high impact (e.g., could lead to unauthenticated arbitrary code execution). As a result, we backported this update to earlier versions of FME and released a patch and Engine upgrade option that FME Flow administrators can apply to their current deployment without performing a full upgrade.
FME Form Remediation:
FME Flow Remediation Options:
FME Flow Hosted Remediation Options:
- Option 1: Apply Optional Instance Update via the FME Flow Hosted User Interface
- Option 2: Upgrade FME Flow instance
Default Behavior Changes: As a result of these security changes required to address these vulnerabilities and support ongoing hardening, the ability to specify TCL and FME Functions in parameter and attribute values has been disabled or reduced in the fixed versions and instances that have been patched according to the instructions in this advisory. After remediation, some transformers and advanced scripting features, unlikely to be used by most workspaces, may be impacted. For more information about these default behavior changes, please see Known Issues and Considerations: Behavior Changes After November 2026 FME Security Updates & Hardening.
Resolution Conditions: Only deployments with the Default Recommended hardening tier selected (in FME 2026.2+) or deployments running default security settings (in the remediated pre-2026.2 releases described in this advisory) are protected from these vulnerabilities. Deployments implementing the minimal tier or with custom overrides may still be susceptible to the vulnerabilities described in this advisory.
FME Form Remediation
Applying Backported Security Fixes for FME Form: Upgrade FME Form
Please visit our Downloads page for the latest versions and refer to our documentation for updating instructions for FME. If you require hands-on assistance to update, we recommend consulting with one of our Partners.
| FME Form Release | Recommended latest versions: Upgrade to a release greater than or equal to | Available via Support upon request: Fixed installers for previous releases |
|---|---|---|
| 2026.3.1+ | FME Form versions 2026.3.1+ are not affected by the vulnerabilities described in this advisory. | |
|
2026.3.0
FME Form versions 2026.2.0, 2026.2.1, and 2026.3 are not affected by the vulnerabilities described in this advisory. However, we recommend upgrading to these hotfix versions, which resolve a regression affecting packaged formats. |
2026.3.1 2026.2.1.2 |
2026.3.0.1 2026.2.0.1 |
| 2026.1 | 2026.1.2.1 |
2026.1.0.1 2026.1.1.1 |
| 2025.2 | 2025.2.4.2 |
2025.2.0.1 2025.2.1.1 2025.2.2.1 2025.2.3.1 |
| 2025.1 | 2025.1.3.5 |
2025.1.0.2 2025.1.1.1 2025.1.2.1 |
| 2025.0 | 2025.0.3.2 |
2025.0.0.1 2025.0.1.1 2025.0.2.1 |
| 2024.2 | 2024.2.5.2 |
2024.2.0.1 2024.2.1.1 2024.2.2.1 2024.2.3.1 2024.2.4.1 |
FME Flow Remediation
Option 1: Upgrade FME Flow
Please visit our Downloads page for the latest versions and refer to our documentation for upgrading instructions for FME. If you require hands-on assistance to upgrade, we recommend consulting with one of our Partners.
| FME Flow Release | Upgrade to a release greater than or equal to |
|---|---|
| 2026.3.1 |
FME Flow versions 2026.3.1+ are not affected by all the vulnerabilities described in this advisory. |
| 2026.3.0 2026.2.x |
The following FME Flow versions are not affected by the vulnerabilities described in this advisory, with the exception of the Arbitrary File Overwrite (Zip-slip) vulnerability (CVE pending):
Although FME Form versions 2026.2+ and 2026.3+ are not vulnerable, we recommend upgrading to these hotfix versions, which resolve a regression affecting packaged formats: see Known Issue: Packaged format writers, including the PDF Document Writer, fail with default security settings in FME 2026.3 and backports The following FME Flow versions resolve all the vulnerabilities described in the advisory:
|
| 2026.1 | 2026.1.2.1 |
| 2025.2 | 2025.2.4.2 |
| 2025.1 | 2025.1.3.5 |
| 2025.0 | 2025.0.3.2 |
| 2024.2 | 2024.2.5.2 |
Option 2: Apply Manual Patch for FME Flow and Upgrade FME Engine(s)
Alternatively, if you are unable to upgrade FME Flow to a fixed version, administrators can remediate these vulnerabilities by completing the following steps. Both steps must be completed to fully remediate the vulnerabilities described in this advisory.
- Apply Patch. Apply the following manual “hotfix” patch to versions from 2024.2.0.0 through 2026.3.0.0. Detailed information about the hotfix is provided in the Frequently Asked Questions below.
- Upgrade FME Engine. Perform an FME Engine-only upgrade using the FME Engine Installer matching your FME release version and build number provided in the table below.
List of Patch Files by Release Version
Choose your FME Flow release and operating system. Each release has two files to download: the patch file (Step 1 of 2) and the engine installer for your operating system (Step 2 of 2).
1. Download Patch
Download and unzip the Patch File. Be sure to download the correct .zip file according to your FME Flow version.
2. Backup FME Flow
We recommend backing up your FME Flow instance before applying the patch. A full backup is optional, but is best practice. See Backup & Restore FME Flow documentation.
3. Stop the FME Flow Services
Before continuing, stop FME Flow System Service
4. Deploy Hotfix
On Windows:
Open an administrative command prompt. Change the directory to the location where the package files have been extracted (i.e. cd <hotfix_dir>)
Run the command:
.\hotfix.bat install
Confirm that the hotfix deployed successfully. The previous command output should include "install complete: fmeflow"
On Linux:
Using the terminal, cd to the location where the package files have been extracted (i.e. cd <hotfix_dir>)
Run the command:
sudo FME_FLOW_HOME=<FME_FLOW_INSTALL_DIR> ./hotfix.sh install
Where <FME_FLOW_INSTALL_DIR> is the base dir of where FME Flow was installed (default location on Linux is /opt/fmeflow)
Confirm that the hotfix deployed successfully. The previous command output should include "install complete: fmeflow"
5. Upgrade FME Engine(s) - Optional
Download the appropriate FME Engine installer for your version of FME Flow. Follow the steps in Upgrade FME Engine Only
6. Restart FME Flow Services
Restart FME Flow System Service
7. Disable Broadcast Message
Disable any Broadcast Message that is no longer relevant (System Configuration > Broadcast Message).
Manual patches provided have been tested with the specific corresponding release of FME Flow. If you're applying patches to beta builds, customized, or non-Express environments (including any Remote Engine Services), additional testing is strongly recommended to ensure compatibility and stability.
FME Flow Hosted Remediation
Option 1: Apply Optional Instance Update via the FME Flow Hosted User Interface
When a patch is available for your FME Flow Hosted instance, you can apply it from the instance page. If something goes wrong, you can roll back using the snapshot taken automatically before the patch was applied.
Applying a Patch
The FME Flow Hosted instance must be in the Running state before you can apply a patch.
1. Open FME Flow Hosted
In FME Flow Hosted, select the affected instance to open its instance page. Instances that need attention are marked with an orange icon.
2. Review Update
In the Triggered Alerts panel, find the FME Flow Update Available message and click Review Update. This displays the updates that will be applied, with links to the release notes for each.
3. Apply Update
Click Apply Updates. The instance moves to the Paused state, and an automatic snapshot is taken as a backup before the updates are applied. The update may take some time to complete.
When the update is complete, the FME Flow Version panel on the instance page shows the newly installed update.
Rolling Back a Patch
1. Open FME Flow Hosted
In FME Flow Hosted, open the instance page for the affected instance and select the Backups tab.
2. Rollback Instance
Click the ellipsis menu next to the snapshot taken before the patch and select Rollback Instance.
In the confirmation dialog, click Rollback. The instance moves through the following states: Pausing, Rolling Back, Starting, Performing Maintenance, and finally Running.
3. Confirm Rollback
After the rollback completes, the FME Flow Version panel shows that the patch is no longer applied.
Option 2: Upgrade FME Flow Hosted instance
Upgrade your FME Flow Hosted instance to a fixed version.
Workarounds
If you are unable to apply the applicable remediation options listed above, you can limit your risk exposure by ensuring your deployment is locked down from outside access, i.e., internal network only.
FME Flow administrators may take the following actions to mitigate the impact of the arbitrary file overwrite (zip-slip) vulnerability:
- Restrict who holds accounts on the platform; treat every FME Flow user as capable of writing files and executing code on the application-server host.
- If using an unauthenticated Flow app with file upload parameters, do not expose the Flow web deployment to untrusted networks and treat everyone with network access as capable of writing files and executing code on the application-server host.
FME Flow Hosted users may consider using the IP restricting feature on their instances for additional protection.
There may be other mitigations and compensating controls available in your organization, depending on your security posture, defense-in-depth strategies, and configurations of perimeter firewalls and appliance firewalls. All organizations must decide for themselves whether to rely on those protections.
Frequently Asked Questions
I have questions about the FME Flow hotfix patch
See FME Flow Hotfix Installer | FAQ
How can I verify that the patch has been correctly applied? Is there an incremented version number?
No, the patch will not modify the version number, but you can verify the patch application by checking that the “Date Modified” of the patch files displays a timestamp in February 2026 to confirm the files have been correctly updated:
- For versions 2023.2.x through 2025.0.x: fmeserver.jar and server-internal-api.jar
- For versions 2025.1.x and newer: fmeserver.jar
Alternatively, SHA-256 hashes are provided for each file (see List of Patch Files by Release Version) to support change monitoring and independent file integrity verification using native system utilities or other tools available within your organization.
Why am I receiving a broadcast message?
Safe Software Inc. issues broadcast messages only for critical security updates and advisories that may impact FME Flow deployments. These messages are designed to provide timely and essential information while avoiding unnecessary notifications. Broadcast messages are retrieved via a pull model over HTTPS. Messages are pulled every 12 hours from api.safe.com over HTTPS, ensuring secure retrieval and optimized frequency. See our documentation for more information about Broadcast Messages in FME Flow.
Will the broadcast message about this issue disappear after the update is applied?
No, but the broadcast message can be manually disabled. FME Flow administrators can manage broadcast messages, and starting in FME Flow 2024.2, individual users can also dismiss broadcast messages.
Does Safe Software plan to release more manual security patch files in the future?
In response to the significant impact of artificial intelligence (AI) on vulnerability discovery and disclosure cycles, we are currently re-evaluating our Product Support Policy. Our goal is to simplify your experience in choosing which versions to upgrade to, and to ensure that future security updates remain as accessible as possible for specific FME releases. Further details regarding eligible FME versions and updates to our Product Support Policy will be shared in an upcoming announcement.
Reporting Security Issues
If you believe you have discovered a vulnerability in the FME Platform, our website, or any of our other products, please contact us as quickly as possible at security(at)safe(dot)com, following the guidelines in our Vulnerability Disclosure Policy.
We greatly appreciate the efforts of security researchers and discoverers who share information about potential security issues with us. Your contributions help us to improve our products and better protect our users.
Please note that while we highly value your contributions, we do not offer compensation for the identification of potential or confirmed security vulnerabilities.
Support
If you have questions or concerns regarding this advisory, please submit a Support Ticket.