| Feature | Various |
| Product |
FME Form FME Flow |
| Description | As a result of security changes introduced in FME 2026.2 and backported to specified earlier versions, the ability to specify some TCL and FME Functions in parameter and attribute values has been disabled in the fixed versions and instances that have been patched according to the instructions in the advisory. After upgrading or patching, some transformers and advanced scripting features, unlikely to be used by the majority of workspaces, may be impacted. |
| Workarounds | Various - See articles below |
| Affects |
FME Form versions:
FME Flow versions:
|
| Status |
Workaround Resolved |
Security Hardening
Known Issues
- Known Issue: EnvironmentVariableFetcher fails with default security settings in FME 2026.2 and backports
- Known Issue: @ConvertBase function fails with default security settings in FME 2026.2 and backports
- Known Issue: FME Form 2026.2 and backported versions fail to open after an invalid JSON security override is applied
- Known Issue: FME Flow 2026.3.x and backported versions fail to re-register FME Engines after an invalid JSON security override is applied
- Known Issue: Packaged format writers, including the PDF Document Writer, fail with default security settings in FME 2026.2 and 2026.3
- Known Issue: OpenStreetMapInAR sample workspace fails in FME Flow 2026.2, 2026.1, 2025.2, and 2025.1
Considerations
- TempPathnameCreator in FME 2026.2 and backports
- TclCaller in FME 2026.2 and backports
- Environment variable expansion (${VAR}) in user parameters in FME 2026.3.1 and later
Support
If you have any questions or encounter an issue not mentioned in the referenced articles, please contact Support.