When an image is retrieved from a BLOB column then it is advised to define/use an Application Process which can display the profile picture(s) for/of the user.
Be careful how this is used. If you don't implement some form of browser caching, then a report which displays 500 images inline on a page will result in 500 requests to the APEX engine and database, per user per page view! Ouch! And then it's a matter of time before a DBA starts hunting for the person slamming their database and reports that "APEX is killing our database". There is an excellent explanation of cache headers here.
begin
for c1 in (select *
from apex_comments_users
where empno = :FILE_ID) loop
--
sys.htp.init;
sys.owa_util.mime_header( c1.profile_picture_mimetype, FALSE );
sys.htp.p('Content-length: ' || sys.dbms_lob.getlength( c1.profile_picture));
sys.htp.p('Content-Disposition: attachment; filename="' || c1.profile_picture_filename || '"' );
sys.htp.p('Cache-Control: max-age=3600'); -- tell the browser to cache for one hour, adjust as necessary
sys.owa_util.http_header_close;
sys.wpg_docload.download_file( c1.profile_picture );
apex_application.stop_apex_engine;
end loop;
end;