Issue Summary

The Confluence REST API endpoint for creating attachments (POST /rest/api/content/{id}/child/attachment) lacks server-side validation for the filename parameter within multipart/form-data requests. Currently, the API successfully processes and persists uploads even when the filename is provided as an empty string, null, or consists only of whitespace.

When this occurs, Confluence creates a nameless attachment (null or empty title). These "nameless" attachments result in:

• UI inconsistency: The attachments appear in the Confluence UI as invisible or non-clickable entries, making them impossible for standard users to manage, download, or delete via the "Attachments" view.
• Any user or automated process with "Add Attachment" permissions can programmatically populate a space with nameless files, leading to potential clutter and administrative overhead, as these files typically require direct database intervention or specific API calls (using the Attachment ID) to clean up.

Steps to Reproduce

1. Identify a Confluence page ID to which you have "Add Attachment" permissions.
2. Prepare a REST API call (e.g., using curl) to upload a file.
3. In the multipart/form-data body, explicitly set the filename parameter to an empty string (""). 
4. Execute the request.
5. Navigate to the Confluence page in a browser and view the Attachments list.

Example:

• Create a dummy file on your instance-> 

  echo "This is a test file for replication" > test.txt

• In Confluence UI> Go to any page you have permission to edit > Select the page id
• Replace page id in below curl command  

  curl -v -u username:password -X POST -H "X-Atlassian-Token: no-check" -F "file=@test.txt;filename=" "<base-url>/rest/api/content/<yourpageid>/child/attachment"

   

• You should see HTTP/1.1 200 OK in the terminal output and in the Attachments page for that specific Page ID. You should see a new entry with a blank name.

Expected Results

The REST API should perform server-side validation. If the filename is null or empty, the API should reject the request with an HTTP 400 Bad Request error.

Actual Results

The API returns an HTTP 200 OK or 201 Created. In the UI, the attachment appears in the list but has no name/text, making it impossible to click or manage normally. In the database, a record is created in the CONTENT table with contenttype = 'ATTACHMENT' and an empty TITLE.

Workaround

None at the moment.