File upload/download not honoring directories

[Hardcore-fs]

consider:

curl -v -0 -T DSCN0369.JPG http://192.168.5.177/upload/

This should upload to the upload directory, but if there is not a directory existing, then the file goes into the "root" /
with possible security issues.

Furthermore
on initial inspection:
http://192.168.5.177/upload/DSCN0369.JPG

pulls the file back.
But so does.........
http://192.168.5.177/hello_big_boy/DSCN0369.JPG

Even if the directory does not exist, then the file can be returned.