File Attachment Security: What File Types Can You Upload?

What File Types Can You Upload?

Attachment Security

What file types can I upload as an attachment?

You can upload 147 file types, covering documents, images, video, audio, archives, design files, code, and data files. If a file type isn't on the approved list, it's blocked by default rather than allowed by exception.

What file types are blocked?

28 file types are blocked because they can run programs or install software. This includes Windows executables (exe, dll, msi), Mac and Linux binaries (so, dylib, bin), auto-running scripts (bat, vbs, ps1), and mobile or desktop installers (apk, dmg, deb). These are blocked regardless of what the file claims to be.

Why are some file types blocked and others allowed?

Blocked file types run code the moment they're opened. That makes them the most common way malware spreads through shared files. The permitted list covers formats people actually need for business, like documents, spreadsheets, images, and code files, none of which execute on their own.

Can I now upload code files and HTML files?

Yes. Source code (JavaScript, Python, Java, and others) and web files (HTML, CSS) were previously blocked. They're now permitted, in line with what other project tools allow.

If code files are allowed, can they run in my browser?

No. Only 26 file types can display or play directly in the browser: images (except SVG), PDFs, video, audio, and plain text. Everything else, including all code and HTML files, downloads as a plain file. It cannot execute or run.

What happens if I upload a file with no extension?

It's refused, with a message telling you the extension wasn't recognized. A file like "README" with no extension won't be accepted.

Can someone trick the system by renaming a file, like invoice.pdf.exe?

No. Only the final file extension is checked. A file named invoice.pdf.exe is read as an .exe file and blocked, even though "pdf" appears in the name.

Does it matter if the file extension is uppercase or lowercase?

No. PAYLOAD.EXE is blocked exactly the same as payload.exe. The check isn't case-sensitive.