Found part of the problem. It uses the form like $dataSaveEnabled is not enabled. (but it is)
When in block_express_form_submission.php I remove: $dataSaveEnabled && on line 11 attachments are included in the emails.
Its a hack, someone has the solution though?

This actually looks like a mistake along the way. The variable $dataSaveEnabled is given the value of the variable $saveData which is grabbed from the Express Form Block controller.

The problem is the controller doesn't actually have that variable. It doesn't exist.

So since $saveData in the block's controller doesn't exist, $dataSaveEnabled in the email template is always false.

And since blocks are not instantiated using Laravel's container there is no graceful way fo dealing with that.

So the way to deal with the problem is to copy the email template concrete\mail\block_express_form_submission.php and put the copy inside application\mail\block_express_form_submission.php

Then modify the copy by adding at the top


Now C5 will use your copy of the template. It's still the same hack you're using pretty much but you won't break anything or loose your modification next time you upgrade C5.