Sorry about the delay - I was out of town and am playing catch-up.
This is a bug when PHP is being run as a "CGI" (probably makes no sense to you:). You can either re-download v1.87 for the fix or search and replace the following line in edituser.php and upload.php (search for the string "$targdir" to find it):
$targdir = substr($_SERVER['SCRIPT_FILENAME'],0,strrpos($_SERVER['SCRIPT_FILENAME'],'/')) . '/attach';
Change to:
$targdir = getcwd(). '/attach';
The fix will be in all future releases.
Regards