diff --git a/src/test/java/gov/cabinetoffice/gap/applybackend/web/SubmissionControllerTest.java b/src/test/java/gov/cabinetoffice/gap/applybackend/web/SubmissionControllerTest.java
index 7d32a635..0a86f4a6 100644
--- a/src/test/java/gov/cabinetoffice/gap/applybackend/web/SubmissionControllerTest.java
+++ b/src/test/java/gov/cabinetoffice/gap/applybackend/web/SubmissionControllerTest.java
@@ -771,6 +771,53 @@ void removeAttachment_RemovesFileFromS3_AndDeletesDatabaseEntry() {
         verify(submissionService).handleSectionReview(APPLICANT_USER_ID, SUBMISSION_ID, SECTION_ID_1, Boolean.FALSE);
     }
 
+    @Test
+    void postAttachment_SavesTheDocumentCleansFilenameAndCreatesADatabaseEntry() {
+
+        final String questionId = UUID.randomUUID().toString();
+
+        final SubmissionQuestionValidation validation = SubmissionQuestionValidation.builder()
+                .mandatory(true)
+                .allowedTypes(new String[] {"txt"})
+                .build();
+
+        final SubmissionQuestion question = SubmissionQuestion.builder()
+                .questionId(questionId)
+                .validation(validation)
+                .build();
+
+        section2.setQuestions(List.of(question));
+
+        final MultipartFile file = new MockMultipartFile(
+                "file",
+                "<>/?|hello.txt",
+                MediaType.TEXT_PLAIN_VALUE,
+                "Hello, World!".getBytes()
+        );
+
+        final GetNavigationParamsDto expectedNavigation = GetNavigationParamsDto.builder().build();
+
+        when(grantApplicantService.getApplicantFromPrincipal())
+                .thenReturn(grantApplicant);
+
+        when(submissionService.getSubmissionFromDatabaseBySubmissionId(APPLICANT_USER_ID, SUBMISSION_ID))
+                .thenReturn(submission);
+
+        when(submissionService.getNextNavigation(APPLICANT_USER_ID, SUBMISSION_ID, SECTION_ID_2, questionId, false))
+                .thenReturn(expectedNavigation);
+
+        final ArgumentCaptor<GrantAttachment> attachmentCaptor = ArgumentCaptor.forClass(GrantAttachment.class);
+
+        final ResponseEntity<GetNavigationParamsDto> methodResponse = controllerUnderTest.postAttachment(SUBMISSION_ID, SECTION_ID_2, questionId, file);
+
+        verify(attachmentService).attachmentFile(application.getId() + "/" + SUBMISSION_ID + "/" + questionId + "/" + file.getOriginalFilename().replaceAll("[<>\"\\\\/|?*\\\\]", "_"), file);
+        verify(grantAttachmentService).createAttachment(attachmentCaptor.capture());
+        verify(submissionService).saveSubmission(submission);
+
+        assertThat(methodResponse.getStatusCode()).isEqualTo(HttpStatus.OK);
+        assertThat(methodResponse.getBody()).isEqualTo(expectedNavigation);
+    }
+
     @Test
     void getNextNavigationForQuestion_ReturnsExpectedResult() {