Known Issue: Packaged format writers, including the PDF Document Writer, fail with default security settings in FME 2026.2 and 2026.3

Known Issue ID	FMEENGINE-99668
Feature	PDF Document Writer (and other packaged formats)
Product	FME Form FME Flow
Versions Affected	FME Form versions: 2026.3 2026.2.1 2026.2 FME Flow versions: 2026.3 2026.2.1 2026.2
Status	Resolved 2026.3.0.1 2026.2.1.2 2026.2.0.1

Issue

In FME 2026.3, 2026.2.1, and 2026.2, workspaces that use the PDF Document Writer may fail when run under the Default Hardening tier, producing the following error:

Security: Engine command-line directive `SAFE.DOCUMENTPDF.DOCUMENTPDF_1_DATASET' is not allowed. This workspace may require a capability not permitted by your current security settings. See https://fme.ly/ybu for more information

Other packaged formats whose engine directives follow the same SAFE.<package>.<format>_DATASET naming pattern may also be affected.

FME Flow instances with the hotfix patch and upgraded engine installed (and FME Flow Hosted instances with the optional FME Security Update November 2026 instance update applied) as described in the FME November 2026 Security Updates, are not affected by this issue.

Cause

As a result of security changes in FME 2026.3, FME 2026.2.1, and FME 2026.2, engine command-line directives are restricted to an allow-list under the Default Hardening tier. A bug in how wildcards in this allow-list are expanded means that directive names containing periods, such as those used by packaged formats, are not matched and are blocked in error.

Workaround

Apply Security Override

Apply the following security override according to the instructions detailed in the article Security Hardening in FME 2026.2:

{
  "security": {
    "mapping_file": {
      "additional_allowed_cli_directives": ["SAFE.*.*_DATASET"]
    }
  },
  "version": 1
}

FME Flow Hosted users running an FME Flow version prior to 2026.2 are invited to contact Support for assistance with applying overrides, as there is no mechanism for FME Flow Hosted users to independently apply overrides.

Change the Security Tier

Alternatively, changing the security tier to the Minimal Hardening tier will allow the PDF Document Writer to work again.

Minimal Hardening is not recommended for most users.

If you apply the security override or change the security tier, we strongly advise you to restore your security configuration once a fixed version becomes available. You can do this by reversing the override or switching the security tier back to Default Hardening.

Search