For receipt attachments for expense reports can you upload executable or malicious files?

Writing the rest of the question here as the question exceeds the character limit:

"For receipt attachments for expense reports can you upload executable or malicious files?What file types are accepted? How does Oracle prevent malicious uploads to the Mobile App?"

It appears Oracle do perform a scan for the uploaded files -  my question is if Oracle performs a scan post upload, does it delete or quarantine or alert (or take any action) in case the uploaded file is found malicious or suspicious in any way during the scan.

Thanks