Pagure does not scan files attached on a new issue for viruses even when VIRUS_SCAN_ATTACHMENTS is set to True. Issue comments are scanned properly but the initial issue itself is not.
Could you check if it works when uploading multiple files in one go?
Metadata Update from @pingou: - Issue assigned to pingou
Should be addressed by https://pagure.io/pagure/pull-request/2371 if you have a way to test it :)
Commit c3cda163 fixes this issue