Hey, i found an example that i think would be helpful for you:
https://github.com/corda/blacklist.
You can upload an attachment to a node via HTTP:
<form action="/upload/attachment" method="post" enctype="multipart/form-data">
<div class="form-group">
<input type="file" name="jar" class="form-control">
</div>
<br>
<button type="submit" class="btn btn-default">Upload JAR</button>
</form>
Or you can upload an attachment using an RPC client:
val nodeAddress = parse(arg)
val rpcConnection = CordaRPCClient(nodeAddress).start("user1", "test")
val proxy = rpcConnection.proxy
val attachmentHash = uploadAttachment(proxy, JAR_PATH)
Then you add the attachment to a TransactionBuilder as follows:
val txBuilder = TransactionBuilder(notary)
.addAttachment(attachmentHash)
It is up to you where you get the attachment hash. You may pass it as an argument to the flow, for example.