It is possible to upload malicious files to the server.

[Viral Vora]

We want to restrict only certain type of attachments to be uploaded in JIRA i.e. only files with extensions pdf, xls, doc are to be allowed to be uploaded. How can the same be restricted

[Dieter]

I am not aware of a way how this can be configured in Jira. but one could implement an event listener which upon upload of a malicious file immediately removes this again and maybe notifies the logged in user by sending an email. This would also catch attachments created by an mail handler. Hopefully time after time users will learn that it makes no sense to attach the type of files you don't want ;)