Support

ATS works fine as can be attested by the attachments we receive every day in our clients' tickets.

First check that file uploads work on your host at all. You can try uploading a few images using Joomla!'s Media Manager. If this does not work that's your problem and you need to contact your host: most likely the temporary path for PHP uploads is set incorrectly in php.ini.

If you could upload with Joomla!'s Media Manager you need to check your Media Manager settings. Perhaps you are limiting uploads by MIME type but you have not whitelisted the file extensions / MIME types?

I told you :) Before replying I went through the code to make sure we're not doing anything funky. Nope. We are just using Joomla!'s upload features.

There is something you should be aware of. Joomla! 3.4.1 and later come with an automatic upload scanner which will deny uploads if they seem to contain PHP code. The code detects "<?", "<?php" and ".php" to determine that. If you are trying to upload an image with EXIF data that contain any of these the strings then the upload will be rejected. Moreover, if you are using double extensions like foo.jpg.php or try to upload a PHP file it will also be rejected. This is a security feature of Joomla! and cannot be turned off.

Apart from that, go to /administrator/index.php?option=com_config&view=component&component=com_media on your site and configure the uploads restrictions there. Just to make sure if this is what restricts your uploads try setting Restrict Uploads and Check MIME Types to No.

Do remember that PHP has restrictions on the maximum upload size and the maximum POST request size. By default, these are 2Mb. Trying to upload anything bigger will fail. Some hosts set them even lower. I've even seen them being as low as 64Kb. Try uploading a tiny text file first. If that works, contact your host.

If uploads fail even when you turn off these features then your server's upload is FUBAR. Go to System, System Information. Under PHP Settings make sure that File Uploads is set to On. Under PHP Information you will find several useful information:
max_file_uploads is how many files can be uploaded. Must be at least 1. The default PHP value (20) is ideal.
upload_max_filesize is the maximum uploaded file size. Make sure it's big enough.
post_max_size is the maximum size of a POST request. Must be equal or greater than upload_max_filesize.
upload_tmp_dir is where the uploads are temporarily stored. This MUST be writeable by PHP. If unsure, contact your host.
If any of these values pose a problem to you, contact your host. These are PHP configuration values. The process of modifying them varies by host. Some hosts require you to have them do it for you, others let you use a .user.ini (dot user dot ini) file in your site's root with the custom values. Other hosts tell you to do that through their control panel. It's a crap shoot so just ask your host.

The Joomla! security feature can be turned off by developers, on a field by field basis.

Akeeba Release System only allows uploads from authenticated users with an Administrator or Super User privilege. These are people who, by definition, you trust with your site. Therefore it makes sense for me to disable the upload scanning for ARS.

Akeeba Ticket System, on the other hand, allows by definition untrusted third parties to upload stuff to your site through the front-end. At best they will be registered users, i.e. you have verified their email. At worst they will be total strangers who are performing a drive-by attack. Therefore it makes sense to leave the upload scanning turned on.

And yes, if your goal is to provide your users with a dev release that fixes a bug they have reported it makes much more sense using BleedingEdge categories in ARS. This works much better as it allows other people who come across the (public) ticket to download and test the same dev release. With an ATS attachment they wouldn't be able to do that since the default setting is Private Attachments, i.e. only you and the ticket owner can see the attachments.