diff --git a/application/Espo/Resources/metadata/app/acl.json b/application/Espo/Resources/metadata/app/acl.json
index 03ce485858..f2132e5cd5 100644
--- a/application/Espo/Resources/metadata/app/acl.json
+++ b/application/Espo/Resources/metadata/app/acl.json
@@ -61,9 +61,6 @@
         "fieldLevel": {
         },
         "scopeFieldLevel": {
-            "Attachment": {
-                "parent": false
-            },
             "EmailFolder": {
                 "assignedUser": {
                     "read": "yes",
diff --git a/application/Espo/Resources/metadata/app/aclPortal.json b/application/Espo/Resources/metadata/app/aclPortal.json
index c697c6bf28..3b444295b7 100644
--- a/application/Espo/Resources/metadata/app/aclPortal.json
+++ b/application/Espo/Resources/metadata/app/aclPortal.json
@@ -78,9 +78,6 @@
             "Meeting": {
                 "reminders": false
             },
-            "Attachment": {
-                "parent": false
-            },
             "Note": {
                 "isInternal": false,
                 "isGlobal": false
diff --git a/application/Espo/Services/Attachment.php b/application/Espo/Services/Attachment.php
index 43330497b3..86cfc66deb 100644
--- a/application/Espo/Services/Attachment.php
+++ b/application/Espo/Services/Attachment.php
@@ -88,12 +88,32 @@ class Attachment extends Record
         }
     }
 
+    public function filterUpdateInput(StdClass $data): void
+    {
+        parent::filterUpdateInput($data);
+
+        unset($data->parentId);
+        unset($data->parentType);
+
+        unset($data->relatedId);
+        unset($data->relatedType);
+    }
+
     public function filterCreateInput(StdClass $data) : void
     {
         parent::filterCreateInput($data);
 
-        if (empty($data->file)) {
-            return;
+        unset($data->parentId);
+
+        unset($data->relatedId);
+        unset($data->relatedType);
+
+        if (!property_exists($data, 'file')) {
+            throw new BadRequest("No file contents.");
+        }
+
+        if (!is_string($data->file)) {
+            throw new BadRequest("Non-string file contents.");
         }
 
         $arr = explode(',', $data->file);