Known Issue: @ConvertBase function fails with default security settings in FME 2026.2 and backports

Issue

In FME 2026.2 and specified versions containing backported security updates, the ConvertBase function may fail when called directly, rather than using it via the BaseConverter transformer, throwing the error message:

Cause

As a result of security changes, the ability to specify some TCL and FME Functions in parameter and attribute values has been disabled or reduced, impacting some transformers and advanced scripting features.  

This applies to the updated versions and instances that have been patched according to the instructions in the advisory: 
 

FME Form versions:

• 2026.2
• 2026.1.0.1, 2026.1.1.1, 2026.1.2.1
• 2025.2.0.1, 2025.2.1.1, 2025.2.2.1, 2025.2.3.1, 2025.2.4.2
• 2025.1.0.2, 2025.1.1.1, 2025.1.2.1, 2025.1.3.5
• 2025.0.0.1, 2025.0.1.1, 2025.0.2.1, 2025.0.3.2
• 2024.2.0.1, 2024.2.1.1, 2024.2.2.1, 2024.2.3.1, 2024.2.4.1, 2024.2.5.2

FME Flow versions: 

• 2026.2
• 2026.1.2.1
• 2025.2.4.2
• 2025.1.3.5
• 2025.0.3.2
• 2024.2.5.2
• FME Flow instances with the hotfix patch and upgraded engine installed per the resolution option for backported security fixes described in the FME November 2026 Security Updates:
  • 2026.1.0.0 through 2026.1.2.0
  • 2025.2.0.0 through 2025.2.4.1
  • 2025.1.0.0 through 2025.1.3.4
  • 2025.0.0.0 through 2025.0.3.1
  • 2024.2.0.0 through 2024.2.5.1

Workaround

Apply Security Override

Alternatively, apply the following security override according to the instructions detailed in the article Security Hardening in FME 2026.2: 

{
 "security": {
    "functions": {
      "evaluateexpression": {
        "additional_allowed_fme_functions": [
          "ConvertBase"
        ]
       }
      }
     },
 "version": 1
}

FME Flow Hosted users running an FME Flow version prior to 2026.2 are invited to contact Support for assistance with applying overrides, as there is no mechanism for FME Flow Hosted users to independently apply overrides.

Change the Security Tier

Alternatively, changing the security tier to the Minimal Hardening tier will allow BaseConverter to work again. 

Minimal Hardening is not recommended for most users.

Resolution

Currently, this issue is resolved in FME 2026.2.1. If you apply the security override or change the security tier, we strongly advise you to restore your security configuration once a fixed version becomes available. You can do this by reversing the override or switching the security tier back to Default Hardening.