@roland Your webserver should reasonably be allowed to read the files in a web application's directory. You should check your webserver config (as in which user it runs as, which user owns the 'file' directory etc.). It's not a #GNUsocial bug anyway (but I think you can set the file upload default umask/permissions, in case webserver config is out of the question or too hard)