This is definitely possible. First create a file field to attach to your order in the control panel. Then create a file
input type with a name attribute that uses the field you created name="fields[fieldName]"
. This would then get sent in the post request to updateCart
.
<form method="POST" enctype="multipart/form-data">
<input type="hidden" name="action" value="commerce/cart/updateCart">
{{ getCsrfInput() }}
<input type="file" name="fields[fieldName][]">
<button type="submit">Upload file</button>
</form>