The attachment should be create and linked to the expense directly, and not on the expense report (where it is readonly).