Issue 

Images referenced by an external URL do not display in generated PDFs on Pega Platform. 

Symptoms and Impact 

Generated PDFs render successfully, but images sourced from an external HTTP or HTTPS URL are not included in the generated PDF, and no error is displayed. Embedded or locally referenced images are unaffected. This impacts document completeness and user experience. 

Steps to reproduce 

1. On a screen where a PDF document is generated and downloaded by selecting a button, use a PDF template that references an image through an external URL, such as an externally hosted image link. 
2. Generate and download the PDF. Observe that the PDF is created, but the image referenced by the external URL is missing. 

Root Cause 

Starting in Pega Platform 25.1.3 and carried forward into the 26.x and 27.x releases, the default value of the skipExternalResource parameter in the pyPDFSettings Data Transform was changed from false to true. 

This change was an intentional security hardening fix to mitigate a server-side request forgery (SSRF) vulnerability in PDFResourceHandler.getExternalResourceData, where externally referenced URLs, including internal or cloud-metadata addresses, could be fetched and their content embedded in or exposed through the generated PDF. 

With skipExternalResource set to true by default, PDF generation skips fetching externally hosted resources by design. 

This is not a PD4ML library version issue. The behavior is reproducible regardless of the PD4ML jar version because it is governed by the skipExternalResource flag in the pyPDFSettings Data Transform, not the PDF rendering engine. 

Solution 

If the application requires images or resources referenced by external URLs in generated PDFs and the source is trusted:

1. Override the skipExternalResource parameter to false in a custom pyPDFSettings Data Transform at the application class level. 
2. Re-test PDF generation to confirm that the image displays as expected.