Log in as a Confluence administrator, click "Confluence Administration"> "Page and Attachment Security Enhancer"> "Global Configuration", and select "Attachment Upload Restrictions".
...
"Attachment types that need to be restricted when uploading attachments via a web browser or Rest Api" default is: empty (no restrictions).