I'm using private upload on several sites and can confirm that this works. So no need to file a bug issue. > At this stage I imagined that these settings would cause an uploaded file to go inside the `../private` directory. Nope, instead they go into public directory `sites/default/files`. Was my assumption wrong? No. This is indeed what should have happened. The weird bit is that you say that uploaded files (still) go into `sites/default/files`. Where is Drupal picking up that from if you've set the private upload directory to be `../private` and selected the private upload method? Just to make sure, I set up a site to your exact specifications. I.e. with drupal root in the `/demo/drupal` and the private directory in `/demo/private` (where `/` is the Unix *file system* root). I first tested it using the absolute path (i.e. `/demo/drupal` as the private upload directory). That worked without a glitch. I then re-tested it using the relative path to the same directory (i.e. `../drupal`). That also worked without a glitch. I also noted that Drupal threw the following error if I tried to input a non-existing directory as the private upload directory: Warning: mkdir(): Permission denied in drupal_mkdir() (line 2341 of /demo/drupal/includes/file.inc). The directory /demo/bogus does not exist and could not be created. In other words: If Drupal lets use `../private` as private directory without throwing this error, your setup *should* be correct for private upload. I am sorry not to be of more help. It sounds as you're doing the right ting when setting this up, and I cannot see why it does not work. What I usually do in cases like this, is to start with a fresh default installation of the core. This usually works. I then introduces modules one by one, testing after each, to identify the module that triggers the problem.